fix(argocd): wire missing SOPS CMP plugin sidecar on repo-server, add grafana-admin secret

Sidecar container was absent from live repo-server Deployment (never in
helm history), causing sops-secrets Application to fail with cmp-server
socket not found — cascaded CreateContainerConfigError across every app
depending on SOPS-decrypted secrets. Also fixes duplicate version field
in plugin ConfigMap that produced a mismatched socket filename, and adds
an initContainer to fetch the sops binary into a writable emptyDir since
the sidecar runs non-root. grafana-secrets.enc.yaml rewritten from a bare
values file (never valid as a K8s Secret) to a proper Secret manifest so
grafana-admin now actually gets created.

k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml

@@ -11,16 +11,6 @@ data:
     metadata:
       name: sops-secrets-v1.0
     spec:
-      version: v1.0
-      init:
-        command: [sh, -c]
-        args:
-          - |
-            # Install sops if not present
-            if ! command -v sops &> /dev/null; then
-              wget -qO- https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 > /usr/local/bin/sops
-              chmod +x /usr/local/bin/sops
-            fi
       generate:
         command: [sh, -c]
         args: