fix(argocd): wire missing SOPS CMP plugin sidecar on repo-server, add grafana-admin secret

Sidecar container was absent from live repo-server Deployment (never in
helm history), causing sops-secrets Application to fail with cmp-server
socket not found — cascaded CreateContainerConfigError across every app
depending on SOPS-decrypted secrets. Also fixes duplicate version field
in plugin ConfigMap that produced a mismatched socket filename, and adds
an initContainer to fetch the sops binary into a writable emptyDir since
the sidecar runs non-root. grafana-secrets.enc.yaml rewritten from a bare
values file (never valid as a K8s Secret) to a proper Secret manifest so
grafana-admin now actually gets created.

k8s/infra/logging/grafana-secrets.enc.yaml

@@ -1,18 +1,23 @@
-adminPassword: ENC[AES256_GCM,data:qykgCu5Kv5IwzM1JFLXL7wgiAyI=,iv:bAph3Jd4fxuyglS7zrWIwzfUgK/wBwRrcEpKusgFhVk=,tag:ymwdnU/Dxnp54eGur2caoQ==,type:str]
-env:
-    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:FwldsYfbOkRYGcycxn5BHZk/dOZsu23e3UCPo7dJKrcyr0n8dXQ9nH5XVSRHDpLOdRk7wbQwl+4Rgb8bGs21/w==,iv:JkNEfbsEIeE9TGouDA1xgjS4fX+v/sDrimaGpc4iaME=,tag:6Z3X29GKbgd2x6ghWA+CUw==,type:str]
+apiVersion: ENC[AES256_GCM,data:BTs=,iv:xd8LqaXGfzo52SPAQYuUmHVcFD68hST+MRhs5JHjwU4=,tag:oJVWyA9pFBkTTzjB6gmahQ==,type:str]
+kind: ENC[AES256_GCM,data:+bWoytA7,iv:dTjYaCtLsQ63Utq9uW2BNydSFsBFe1z3+Ev9suCjN/k=,tag:Jl00LjJayDxycWKt9sfzew==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:4QXIyXaahJc+++YKcQ==,iv:l1321009Nz16407LDntwoxXAKcrKaGAWYi6uYhlgocw=,tag:vPSTVlxgj0v8cIHf8lI3Gw==,type:str]
+    namespace: ENC[AES256_GCM,data:kegyFUpUTg==,iv:FcKkgCI+yDM0dDFq2+hDbqzwpNCGKQkhXiMXB57IadA=,tag:UyXgT7dJ+5ECY5ptBER08w==,type:str]
+type: ENC[AES256_GCM,data:2a2VYwV4,iv:uwMiEGmUOxvmbHyDtTYN4jflni+z3tgsFsODc4M60yE=,tag:8gEA5x+dPm8svxpEhNNfsA==,type:str]
+stringData:
+    admin-password: ENC[AES256_GCM,data:sLmcTvdXQbI/EfUTyw==,iv:kyIAyCPn6iinaaKcjpGDPtzDoi28GhX8ykImSsZxbOg=,tag:r1Til5RWCej2nLDOXAjnZw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQdVNSMWZaVDZuN2RBKyt0
-            eWJHRm5vRlErZ1UweXA0N2xSNGdESE5leWo4CjQ2TTlONnpJK2VZWmxoamdhdHZN
-            ZGVMSU84SUZpVTUxREZlek9JcUxaTXcKLS0tIHlNaEpzZG1iaVpvU0E1UTQzbkVk
-            WnQxSHZ6S3cyZ2hUTlpTNXQyaVZzRU0KwU/0aRJ0D/UsqtFcrJLmuHpNELhTsfYS
-            4WL2TQ/yaUz261s7LEVQdpKUza8JjQXiKqqNcV2gaqEWurdx20ILzQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAycTcwSEdVbXkvd1RLMmNK
+            ZzZWSVB1RHZaK2RhbmZCYmI5eFZPN05KUG1NCkl5WW54VjZJM1U2ODFGd3NDQkVH
+            OHRDaFVoL3Rqdm5YVFJodkZGNWxzNE0KLS0tIGVwVC9velV2d0doSklScWtuQk8v
+            c1l4TWdrL1JhUjYxRm8zNEdMcTJGVkEK43xCEPxYJa0nv7AJixflsawuKkcjNnPu
+            lj+PUeQzWNKGziWsEjRMyFCux6hIzr5mwk8R0CAu8WLFWQOKu6Mqag==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T23:02:08Z"
-    mac: ENC[AES256_GCM,data:LeN0mm7i7fsDpwtGQ6La7/UzhHbKfG1f/K30wW7fZJ1XbqPZGh7cdq07kMqrodlR6oWvrq7r4gbyuhcH9ptlxKgN4NuD3OoUjn6/CiPEF+wzgKMMgg2JdqFLsZNxVvGL/Ig3Y5hP5iag91QdtQxXaJmaV6Q9+FF6maYofsOU2rA=,iv:Eik9jEhdu+7qJv1oN7e1Vydnv7rh0pnRpbcBPDhh8e8=,tag:Mkry9bpTsmsf9Xs1jW7b1g==,type:str]
+    lastmodified: "2026-08-11T21:04:35Z"
+    mac: ENC[AES256_GCM,data:rTgYeF39pNDXerJ3mn4J+Cg2JTye3rZnNd7RHUZjayO5S+uvnZa0a7bNBNEXmf0ctqKIamsnPbMDWluNt8/vN9h4AsU0ssajrWH0hK45XYJtAiHJ2YP1CdWgYYMxalsEitw8OnO/eJ70wuxbAs8eVTHIbSVjcDmRYGJyblUjM3U=,iv:E1yYQJpr/MV0RRWNRCZmUvw/Lkr69GtAmpOja014aPs=,tag:OoMR94Y/lhrAeEW8ZEkj3w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.2