docs: submit DevOps best-practice series for human review - #859

Summary

Add three Best Practices articles explaining how to select and operate an ACP DevOps workflow: the overall component choices, commit-to-production delivery, and platform configuration with isolated project onboarding. The articles link to the public companion samples and the relevant versioned product guides.

The reviewed content makes the operating prerequisites explicit: project identities must not read central signing credentials, key rotation must accept either approved public key, approval records must be retained independently, and admission policies need attributable positive and negative controls. It also clarifies webhook failure behavior, Git review boundaries, rollback, signature-storage changes and the scope of the acceptance scripts.

Validation

• The current Knowledge site build, sample shell/YAML checks and Kustomize rendering passed.
• A dedicated real environment exercised platform restoration, two-project onboarding and token rotation, main/MR CI, ordinary-user approval, production promotion/CD, signed rollback, seven resource boundaries, webhook authentication and Results archival after deletion.
• The published delivery acceptance script passed 8 checks in Audit and 8 in Enforce; the onboarding script passed 11 checks for each of two projects. Signing-key rotation passed 15 controls, and the two real Argo identities passed 126 boundary assertions.
• Resolver Audit/Enforce and separate signature-storage follow-up were verified against the final source; temporary settings were restored and exported artifacts were checked for credentials and infrastructure values.

Review and publication

Human review is still required before merge. Review technical accuracy, customer-facing wording, version references, security prerequisites and public sample links. The three English files use kind: Best Practices. Generated translations are not included in this PR and remain part of the repository's post-merge publication workflow.