Added fixes before token usage cutoff. Added required credentials for dns api for cert-manager and external-dns

bootstrap/flux/bootstrap.sh

@@ -31,7 +31,7 @@
 #     source-url.yaml into clusters/dev/kustomization.yaml (or set the URL) so the source is real.
 #   - ./patches/platform-sops-decryption.yaml + apps-sops-decryption.yaml are wired into
 #     clusters/dev/kustomization.yaml `patches:` so decryption is enabled at reconcile.
-#   - .sops.yaml (from ../sops) is installed at the repo root with the real age recipient.
+#   - the repo-root .sops.yaml carries the real age recipient (single canonical file; no copy under ../sops).
 #
 # PHASE 6 (WS-GITOPS, later — NOT Phase 1): once Gitea is up, cut the source over with
 # `flux bootstrap git` against gitea.home.keithjackson.dev — see ../README.md "Phase-6 cutover".