Phase 1 (author-only): Flux + SOPS bootstrap + interface wiring (T-1.4)

bootstrap/sops (age-keygen refusing in-repo, .sops.yaml, install-age-key.sh
glue installing the sops-age Secret) + bootstrap/flux (bootstrap.sh: flux
install -> apply -k clusters/dev; decryption/url patches). PM wiring: place
.sops.yaml at repo root (SOPS walks to root); inline the 3 flux patches into
clusters/dev (avoids kustomize ../ load-restriction). clusters/dev builds with
decryption enabled; full CI gate PASS. No key material; nothing executed.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/dev/kustomization.yaml

@@ -9,6 +9,45 @@ kind: Kustomization
 resources:
   - ../base
 patches:
+  # --- SOPS decryption + bootstrap source (PM-inlined from bootstrap/flux/patches/, 2026-08-16) ---
+  # Inlined (not cross-dir file refs) to stay within kustomize's default load restrictions.
+  # Realises the commented decryption TODOs in clusters/base and sets the real source URL.
+  # The `sops-age` Secret is created out-of-band (bootstrap/sops/install-age-key.sh) — name only.
+  - patch: |-
+      apiVersion: kustomize.toolkit.fluxcd.io/v1
+      kind: Kustomization
+      metadata:
+        name: platform
+        namespace: flux-system
+      spec:
+        decryption:
+          provider: sops
+          secretRef:
+            name: sops-age
+  - patch: |-
+      apiVersion: kustomize.toolkit.fluxcd.io/v1
+      kind: Kustomization
+      metadata:
+        name: apps
+        namespace: flux-system
+      spec:
+        decryption:
+          provider: sops
+          secretRef:
+            name: sops-age
+  - patch: |-
+      apiVersion: source.toolkit.fluxcd.io/v1
+      kind: GitRepository
+      metadata:
+        name: flux-system
+        namespace: flux-system
+      spec:
+        # >>> REPLACE-ME at bootstrap <<< how the local repo is served to the cluster
+        # (git-over-ssh / a git daemon on the NAT gateway, etc. — WS-INFRA/operator, OQ).
+        url: https://REPLACE-ME.invalid/home-network-k3s-impl.git
+        ref:
+          branch: main
+  # --- dev-scoped cluster-vars (R-ENV-02) ---
   - target:
       kind: ConfigMap
       name: cluster-vars