After the BFG scrub, k8s/secret.yaml is git-ignored (contains plaintext
credentials) but kustomization.yaml still listed it as a resource. Flux
has been failing to kustomize-build the prop-app for six days, so no
deployment since main-1776019122-8d1d7e4 has actually reached prod —
the beacons crash fix, UTC clock fix, ASOS nudging, MRMS, contact
detail async hydration, and email config change were all stuck.
The `prop-secrets` Secret is applied out-of-band with kubectl and lives
independently in the cluster; Flux no longer needs to track it.
- libcluster with Kubernetes IP strategy for pod discovery
- RBAC for pod list/get, POD_IP from downward API, shared cookie
- LiveDashboard at /dashboard for all environments
