Verified the Argo Events CRD has an open schema -> trigger-level path-filter negation can't be validated. Redesigned the mode-split to live in the workflow (git diff --name-only) with a single msp-style sensor (lowest risk). 5 tasks: WorkflowTemplate build side, deploy step (verify tailscale route), sensor + decide-mode, apply+webhook, e2e verify both modes + retire old file. Every cluster apply gated behind server dry-run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>