Apply with diff gate per env helmfile

apply runs diff first and only syncs changed releases; idempotent gitops loop