Answer
Install ArgoCD, then apply a single root Application that references a Git directory of child apps covering platform components (ingress, monitoring, cert-manager, secrets) and workloads. Syncing the root cascades to create everything. This 'bootstrap app' is the one manual step; from there GitOps manages the cluster.
kubectl apply -n argocd -f root-app.yaml # the only manual stepReal-world example A new cluster is fully provisioned by installing ArgoCD and applying one root app that pulls in the entire platform.