- overlays/encry configmaps now carry the live cluster values (runbook step 1) plus OIDC_CLIENT_ID; kubectl diff against the cluster is empty. - deploy/k8s/scripts/ensure-secrets.sh adds missing secret keys without touching existing ones (random encryption keys, empty Open-Meteo key, TELEGRAM_BOT_TOKEN=dummy) and never prints values. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>