Document Cilium break-glass recovery

apps/cilium/README.md

@@ -13,3 +13,6 @@ and confirm the rollback/recovery route. Do not remove the retained Cilium Helm
 release record or delete Cilium CRDs as cleanup; the CRDs are not rendered or
 managed by this Argo Application. Argo is the normal writer; the old `cilium`
 repository's installer is break-glass recovery only.
+
+If Argo cannot restore Cilium, see [RECOVERY.md](RECOVERY.md) for the
+break-glass procedure.

apps/cilium/RECOVERY.md

@@ -7,11 +7,20 @@ of this repository and verify `kubectl config current-context` is
 
 The chart version is canonically recorded as `spec.sources[0].targetRevision`
 in `bootstrap/cilium.yaml`; the cluster configuration is in `apps/cilium/values.yaml`.
-Restore the Hubble CA resources from `apps/cilium/resources/hubble-pki.yaml` if
-needed. Then use the Cilium CLI's `upgrade` command with the chart version from
-the Application and those values. Do not uninstall Cilium, delete its CRDs, or
-remove the retained Helm release record during recovery. Once Argo is healthy,
-return all routine changes to GitOps and let it reconcile.
+After checking the context and reviewing the target version, recover the Helm
+release with the Cilium CLI (the CLI expects a `v` prefix):
+
+```sh
+chart_version="$(yq -r '.spec.sources[0].targetRevision' bootstrap/cilium.yaml)"
+cilium upgrade --namespace kube-system --version "v${chart_version}" \
+  --values apps/cilium/values.yaml --wait
+```
+
+Restore the Hubble CA resources from `apps/cilium/resources/hubble-pki.yaml` only
+if they are missing. Do not uninstall Cilium, delete its CRDs, or remove the
+retained Helm release record during recovery. Once Argo is healthy, return all
+routine changes to GitOps and let it reconcile. The command follows the
+documented Cilium CLI upgrade interface.
 
 This is a recovery procedure, not a second deployment path. Keep credentials
 and secret values out of this public repository.