Phase 1 (author-only): Flux + SOPS bootstrap + interface wiring (T-1.4)

bootstrap/sops (age-keygen refusing in-repo, .sops.yaml, install-age-key.sh
glue installing the sops-age Secret) + bootstrap/flux (bootstrap.sh: flux
install -> apply -k clusters/dev; decryption/url patches). PM wiring: place
.sops.yaml at repo root (SOPS walks to root); inline the 3 flux patches into
clusters/dev (avoids kustomize ../ load-restriction). clusters/dev builds with
decryption enabled; full CI gate PASS. No key material; nothing executed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

bootstrap/flux/patches/apps-sops-decryption.yaml

@@ -0,0 +1,21 @@
+---
+# Enable SOPS decryption on the `apps` Flux Kustomization (ADR-0007, R-SEC-01).
+#
+# REALISES the commented TODO in clusters/base/apps.yaml (same pattern as the platform patch).
+# Strategic-merge patch — adds the decryption stanza to the base `apps` Kustomization without
+# forking it (R-ENV-02). `sops-age` Secret referenced BY NAME ONLY (created out-of-band).
+#
+# WIRING (clusters owner / PM): add to clusters/dev/kustomization.yaml `patches:` alongside the
+# platform patch, e.g.
+#     patches:
+#       - path: ../../bootstrap/flux/patches/apps-sops-decryption.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: apps
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age