Advanced ArgoCD Image Updater for Fully Automated GitOps

Act as a Principal GitOps Architect. Design a fully autonomous, zero-human-intervention Continuous Delivery pipeline leveraging ArgoCD combined with the ArgoCD Image Updater component. The architecture must autonomously poll the highly secure [TARGET_REGISTRY] (e.g., AWS ECR or GitHub Container Registry) every 2 minutes. Write the exact Kubernetes annotations required on the ArgoCD `Application` CRD to force the controller to intercept new Docker image tags that strictly satisfy the [SEMVER_CONSTRAINT] (e.g., `~1.2.0` allowing only non-breaking patch updates). Crucially, you must engineer the write-back mechanism: dictate the exact configuration required for the Image Updater to securely authenticate and automatically push a Git commit back to the [GITOPS_REPO], permanently updating the Kubernetes manifests with the new SHA-256 image hash, thereby preserving the absolute immutable single-source-of-truth doctrine of GitOps.