Added fixes before token usage cutoff. Added required credentials for dns api for cert-manager and external-dns

.sops.yaml

@@ -1,12 +1,12 @@
 # .sops.yaml — SOPS creation rules for the platform repo (ADR-0007, R-SEC-01).
 #
 # ─────────────────────────────────────────────────────────────────────────────
-# EFFECTIVE LOCATION: this file must live at the REPOSITORY ROOT to govern
-# encryption of secrets under platform/** and apps/**. It is AUTHORED here in
-# bootstrap/sops/ (the security engineer's subtree); the PM/clusters owner
-# installs it at the repo root (copy or symlink). See bootstrap/sops/README.md
-# "Interface / handoff". SOPS discovers .sops.yaml by walking UP from the file
-# being encrypted to the repo root, so it only takes effect from root.
+# CANONICAL LOCATION: this is the ONE .sops.yaml, at the REPOSITORY ROOT. SOPS
+# discovers it by walking UP from the file being encrypted, so a root file governs
+# every secret under platform/**, apps/**, catalog/**, and secrets/**.
+# There is deliberately NO second copy under bootstrap/sops/ — a duplicate there
+# would be discovered first for files in that subtree and shadow this one (that
+# footgun is why the earlier bootstrap/sops/.sops.yaml was removed).
 # ─────────────────────────────────────────────────────────────────────────────
 #
 # HOW ENCRYPTION WORKS HERE:
@@ -26,11 +26,11 @@ creation_rules:
   # or live under a `secrets/` directory anywhere in the tree.
   - path_regex: (^|/)(platform|apps|catalog)/.*(secret|sops)\.ya?ml$
     encrypted_regex: "^(data|stringData)$"
-    # >>> REPLACE-ME <<< paste the age PUBLIC recipient printed by age-keygen.sh.
-    # Example shape (NOT a real key): age1qy...placeholder...0abcd
-    age: "age1u70g00m38pt4zte00n4fsqfyj3rf8725xn4w7e6lx80evt4rcalsdnprp8"
+    # age PUBLIC recipient (from age-keygen.sh) — safe to commit. To rotate, see
+    # bootstrap/sops/age-key-secret.md (add new recipient, re-encrypt, drop old).
+    age: "age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg"
 
   - path_regex: (^|/)secrets/.*\.ya?ml$
     encrypted_regex: "^(data|stringData)$"
-    # >>> REPLACE-ME <<< same age PUBLIC recipient as above.
-    age: "age1u70g00m38pt4zte00n4fsqfyj3rf8725xn4w7e6lx80evt4rcalsdnprp8"
+    # same age PUBLIC recipient as above.
+    age: "age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg"