feat(secrets): seal cluster secrets missing from GitOps

Sealed from live cluster state — no plaintext ever on disk:
- redis/github (dockerconfigjson pull secret)
- nowchess/remotek6-certs (prod, staging, kargo)

Added to kustomization:
- kargo/discord-webhook-secret
- nowchess/kargo/github-image-secret
- redis/github-pull-secret
- remotek6-certs for all three namespaces

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

secrets/kustomization.yaml

@@ -18,3 +18,9 @@ resources:
   - nowchess/eu-central-1-prod/ncs-internal-secret.yaml
   - nowchess/kargo/git-secret.yaml
   - nowchess/kargo/gitea-secret.yaml
+  - nowchess/kargo/github-image-secret.yaml
+  - nowchess/kargo/remotek6-certs.yaml
+  - nowchess/staging/remotek6-certs.yaml
+  - nowchess/eu-central-1-prod/remotek6-certs.yaml
+  - kargo/discord-webhook-secret.yaml
+  - redis/github-pull-secret.yaml