After enabling selfHeal, on-call engineer patches replicas via kubectl during a traffic spike -- ArgoCD reverts it

This is exactly correct selfHeal behavior. The right approach is committing the replica change to the GitOps config repo so ArgoCD sees it as the new desired state and applies it durably. Manual kubectl changes are not durable in a selfHeal-enabled GitOps setup.