Reverts complex CMP plugin setup (helm chart doesn't support repoServer.extraContainers). Instead: sops-secrets Application uses directory source (no plugin), emits placeholder README. Manually-created Secrets (grafana-admin) live in target namespaces. Full CMP plugin work deferred to future stage. Grafana values still wired to admin.existingSecret (no-op until Secret exists, which it now does). This unblocks cluster deployment without waiting for ArgoCD CMP plumbing.