Added fixes before token usage cutoff. Added required credentials for dns api for cert-manager and external-dns

bootstrap/sops/age-keygen.sh

@@ -12,7 +12,7 @@
 #     ~/.config/sops/age/keys.txt — SOPS's conventional location, honoured by the
 #     SOPS_AGE_KEY_FILE default lookup).
 #   - Prints ONLY the PUBLIC recipient (age1...) to stdout. The public recipient
-#     is safe to paste into bootstrap/sops/.sops.yaml. The PRIVATE key stays in
+#     is safe to paste into the repo-root .sops.yaml. The PRIVATE key stays in
 #     the file and is NEVER printed, NEVER committed (see .gitignore: age.key,
 #     *.key). Spec docs/07 + AGENTS.md §5: no secret material in logs/PR/output.
 #
@@ -81,5 +81,5 @@ age-keygen -o "${key_abs}" >/dev/null
 echo "age private key written (0600) to: ${key_abs}"
 echo "This file is OUTSIDE the repo and must stay that way — do NOT commit it."
 echo
-echo "Public recipient (safe to share — paste into bootstrap/sops/.sops.yaml):"
+echo "Public recipient (safe to share — paste into the repo-root .sops.yaml, both age: lines):"
 age-keygen -y "${key_abs}"     # prints ONLY the public recipient (age1...)