- overlays/encry configmaps now carry the live cluster values (runbook
step 1) plus OIDC_CLIENT_ID; kubectl diff against the cluster is empty.
- deploy/k8s/scripts/ensure-secrets.sh adds missing secret keys without
touching existing ones (random encryption keys, empty Open-Meteo key,
TELEGRAM_BOT_TOKEN=dummy) and never prints values.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
