fix(cloudflared): auditable Service+ServiceMonitor scrape; placeholder-only template value

servicemonitor-ports-resolve could not audit a PodMonitor with no in-repo
Service, and no-plaintext-secrets requires a template's secret value to be a
bare placeholder.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

platform/cloudflared/cloudflared-credentials.sops.yaml.example

@@ -29,6 +29,7 @@ metadata:
   namespace: cloudflared
 type: Opaque
 stringData:
-  # One line of JSON, exactly as `cloudflared tunnel create` wrote it (compacted with `jq -c`).
+  # One line of JSON, exactly as `cloudflared tunnel create` wrote it (compacted with `jq -c`):
+  #   {"AccountTag":"<account>","TunnelSecret":"<base64>","TunnelID":"<uuid>"}
   # TunnelID MUST equal the `tunnel:` UUID in config.yaml.
-  credentials.json: '{"AccountTag":"REPLACE-ME","TunnelSecret":"REPLACE-ME","TunnelID":"REPLACE-ME"}'
+  credentials.json: REPLACE-ME