Mount Argo token in sandbox app pods

[arielr-lt]

Summary

• mount the sandbox Argo token Secret into main-app and worker-app pods
• set ARGO_WORKFLOWS_TOKEN_PATH so the Ruby Argo client can read the bearer token from disk

Notes

• this does not store token data in source control
• the target namespace must provide an argo-workflows-token Secret with a token key

Testing

• parsed updated Kubernetes YAML manifests with Ruby YAML loader
• ran git diff --check