fix: use ksops generator pattern for SOPS-encrypted secrets

- Remove configmap.enc.yaml from resources (blocked kustomize parsing)
- Create secret-generator.yaml with ksops exec plugin config
- ksops decrypts secrets before kustomize reads them
- Allows Image Updater to safely edit images section
- Fixes: ArgoCD repo-server now properly decrypts secrets via ksops plugin

Pattern mirrors homelab/k8s/argocd/secrets/ for consistency

infra/portfolio/base/secret-generator.yaml

@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: portfolio-secrets-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - configmap.enc.yaml