docs: pia-* cluster secrets retired + host vault committed (Phase 3 cleanup complete)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -746,5 +746,14 @@ Operator approved the retirement and asked to update monitoring + docs. Done:
   gates green. Docs agent also caught a stale "NOT WIRED — DO NOT ADD TO kustomization" banner + done-TODO in
   `egress-steering.yaml`; fixed (`75a38da`, comment-only). All three merged agent worktrees + their branches
   pruned — only `main` remains.
-- **Still open (only item):** retire the now-unused `pia-*` cluster SOPS secrets in a separate change (creds
+- **Follow-ups DONE (2026-08-24, operator-approved):**
-  are host-side in the Ansible vault per docs/07).
+  1. Retired the unused `pia-credentials` + `pia-custom-ovpn` cluster SOPS secrets (`509a421`): confirmed no
+     pods/manifests referenced them (the Ansible `pia-credentials.txt` hits are a host file, unrelated),
+     removed from the kustomization + `git rm`'d the files; Flux PRUNED both Secrets (`NotFound`). `vpn-egress`
+     namespace now holds only the CiliumEgressGatewayPolicy. Recoverable from git history if ever needed.
+  2. Committed the ansible-vault-encrypted host VPN creds vault `infra/ansible/inventory/group_vars/
+     vpn_egress_gateway/vault.yml` (`b4ac1be`) — it had been provisioned but never committed, so the
+     `vpn.egress.gateway` playbook was not reproducible. Verified `$ANSIBLE_VAULT;1.1;AES256` in-git (the
+     vault password stays out of the repo via `ansible.cfg vault_password_file`).
+  Phase 3 VPN egress steering (ADR-0015) is now fully implemented, validated, conformance-green, documented,
+  monitored, and cleaned up — gluetun and its cluster secrets are gone.