fix: use ksops generator pattern for SOPS-encrypted secrets

- Remove configmap.enc.yaml from resources (blocked kustomize parsing)
- Create secret-generator.yaml with ksops exec plugin config
- ksops decrypts secrets before kustomize reads them
- Allows Image Updater to safely edit images section
- Fixes: ArgoCD repo-server now properly decrypts secrets via ksops plugin

Pattern mirrors homelab/k8s/argocd/secrets/ for consistency

infra/portfolio/base/kustomization.yaml

@@ -1,17 +1,22 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: portfolio
+
 resources:
 - namespace.yaml
-- configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml
 
+# SOPS-encrypted secrets via ksops generator (ArgoCD repo-server plugin)
+# ksops intercepts encrypted files, decrypts them, returns valid resources
+generatorOptions:
+  disableNameSuffixHash: true
+
+generators:
+  - secret-generator.yaml
+
 # ArgoCD Image Updater configuration - for tag updates
 images:
 - name: forgejo.riotpiao.com/rock/portfolio
   newTag: latest
-
-# Note: SOPS decryption is handled by ArgoCD repo-server plugin,
-# not via kustomization.yaml, to allow Image Updater to parse this file

infra/portfolio/base/secret-generator.yaml

@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: portfolio-secrets-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - configmap.enc.yaml