vikingowl
75a626b127
CI deploy steps now target helm/marktvogt with --reset-then-reuse-values, preserving the other service's image tag across pipeline runs. Each pipeline sets only its own X.image.tag. App-level secrets (smtp/turnstile/discovery/ai/JWT/oauth) moved out of CI's --set chain in the previous phase — now pre-created via scripts/k8s-secrets-sync.sh from .env.helm. The chart's conditional secret templates remain for backward-compat with the live release's stored values but will be removed in a follow-up once those values are cleared. Old per-service chart directories deleted; only the monolithic helm/marktvogt/ remains. MIGRATION.md updated with the actual procedure that worked, including the several pitfalls hit during the live tenant-2 migration on 2026-04-28 (helm uninstall trap, SSA field-manager swap for CRDs, kyverno hostname allowlist for new subdomains).