Adds the deploy half of fleet-operator CD: a manual workflow_dispatch
that installs a published operator chart version via harmony apply,
run from an in-cluster, permissionless runner.
- FleetDeploySecrets (#[config(secret)]) loaded via ConfigClient: the
published-chart path is Zitadel-SSO-only by construction — operator
credentials + deployer kubeconfig come from OpenBao, no user/pass
field reachable. user/pass stays a dev-only rendered-chart flag.
- FleetOperatorScore::credentials() so the published-chart path applies
the operator Secret (was a no-op).
- Deprecate SecretManager in favour of harmony_config::ConfigClient.
Jean-Gabriel Gill-Couture
245d7dd9a5