security: restore old public key in .sops.yaml for cluster decryption

Keep both public keys in .sops.yaml:
- Old key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
  (existing cluster secrets are encrypted with this)
- New key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
  (new secrets will be encrypted with this)

Private keys remain secure in cluster (sops-age secret).
Public key history cleaned from git (see prior commits).

.sops.yaml

@@ -1,17 +1,21 @@
 # SOPS Configuration for secrets encryption
-# Public key is safe to commit; private key stays in cluster
+# Public keys are safe to commit; private keys stay in cluster
 
 creation_rules:
   # Encrypt secrets, configs, and sensitive files
-  # Public AGE key - safe to share and commit
+  # Multiple public keys for key rotation support
   # Files matching these patterns will be encrypted automatically with `sops -e`
   - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
+    age:
+      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable
 
   # Fallback rule for .enc.yaml files
   - path_regex: '.*\.enc\.ya?ml'
-    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
+    age:
+      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'
 
 # To encrypt a file locally:
@@ -23,5 +27,8 @@ creation_rules:
 # To decrypt to stdout:
 #   sops --decrypt k8s/configmap.yaml
 #
-# The private age key is stored in the cluster at:
+# The private age keys are stored in the cluster at:
 #   kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
+#
+# Key rotation: Multiple public keys can coexist for decryption
+# Only private keys MUST be kept secret (in cluster only)