wire Cloudflare DNS token secrets + exempt *.sops.yaml from yamllint

- Rename the committed encrypted secrets to canonical cloudflare-api-token.sops.yaml
  (cert-manager + external-dns namespaces) and uncomment the resource lines in both
  kustomizations, so cert-manager DNS-01 + ExternalDNS get the token at reconcile.
- Exempt **/*.sops.yaml from ci/yamllint.yaml: SOPS re-emits encrypted files with its
  own indentation + long ENC[...] lines (never hand-edited), which was failing the lint
  gate on main after the secrets were committed. Same treatment as **/vault.yml.

Both Secrets confirmed present + encrypted in the platform build; gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

ci/yamllint.yaml

@@ -7,9 +7,13 @@ yaml-files:
   - "*.yaml"
   - "*.yml"
 
-# ansible-vault-encrypted files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML — skip them.
+# Machine-generated encrypted files — skip them:
+#  - ansible-vault files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML.
+#  - SOPS-encrypted secrets (*.sops.yaml) are re-emitted by `sops` with its own indentation
+#    and long ENC[...] / mac lines; they're never hand-edited, so linting them is noise.
 ignore: |
   **/vault.yml
+  **/*.sops.yaml
 
 rules:
   # Kubernetes / Kustomize / Helm manifests routinely exceed 80 cols; allow room

platform/cert-manager/kustomization.yaml

@@ -7,6 +7,5 @@ resources:
   - helmrelease.yaml
   - clusterissuers.yaml
   # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Operator flow:
-  # copy bootstrap/sops/secret-templates/cloudflare-api-token.cert-manager.yaml.example here as
+  # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Flux decrypts at reconcile.
-  # cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
+  - cloudflare-api-token.sops.yaml
-  # - cloudflare-api-token.sops.yaml

platform/externaldns/kustomization.yaml

@@ -6,6 +6,5 @@ resources:
   - helmrepository.yaml
   - helmrelease.yaml
   # SOPS-encrypted Cloudflare token (env CF_API_TOKEN) — SAME token as cert-manager, second copy in
-  # the external-dns namespace. Copy bootstrap/sops/secret-templates/cloudflare-api-token.external-dns.yaml.example
+  # the external-dns namespace. Flux decrypts at reconcile.
-  # here as cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
+  - cloudflare-api-token.sops.yaml
-  # - cloudflare-api-token.sops.yaml