security: rotate SOPS age key - update to new public key only

The old age key was compromised during terminal output exposure.
This commit rotates to a new age key pair:
- Old public key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla (RETIRED)
- New public key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
- Private key: Stored securely in sops-age secret (argocd namespace)

.sops.yaml now uses the new public key for all future encryptions.
Existing encrypted files will be re-encrypted with the new key during next sync.

SECURITY: Private keys must NEVER be exposed in terminal output or git history.

.sops.yaml

@@ -6,12 +6,12 @@ creation_rules:
   # Public AGE key - safe to share and commit
   # Files matching these patterns will be encrypted automatically with `sops -e`
   - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age: ***REMOVED***
+    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable
 
   # Fallback rule for .enc.yaml files
   - path_regex: '.*\.enc\.ya?ml'
-    age: ***REMOVED***
+    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'
 
 # To encrypt a file locally: