feat: zero trust SOPS key isolation (deploy-k3s#32)

- Add test-key (age1wtzdf8...) for shared test environment
- Enable mac_only_encrypted: true in .sops.yaml (SOPS >= 3.9.0)
  Allows adding new YAML fields without decryption key
- Re-encrypt all 10 files with mac_only_encrypted metadata
- Strict isolation: dev-key ↔ *.dev.enc.yaml, prod-key ↔ *.prod.enc.yaml
- test-key can only decrypt *.test.enc.yaml (not dev/prod)
- Add dev/verify-sops-isolation.sh — 33-point verification script
- Keep dev/prod files with admin+dev / admin+prod only (no test-key)

Verified: 33/33 isolation checks passed

Co-authored-by: XoR <xor@benadis.ru>

infra/gitea/values/secret-values.dev.enc.yaml

@@ -1,27 +1,28 @@
 # Gitea secrets for dev/test cluster
-admin-password: ENC[AES256_GCM,data:Nh7IDhZbJxOYjat8JhRoWtQ=,iv:mDtUOdjiKxvTTKaWNQ6bUQ2rCbV9Ule25IN5AVBTrp0=,tag:FxMWUvu82HusjtPBmEtwcA==,type:str]
-db-password: ENC[AES256_GCM,data:qRZjNRGr/oJVzYTz6Kv0sZ7Sbns=,iv:V03c8IrsLZzJck5ZqrXS46LydbGPtLBwkjjGQI0zkv4=,tag:pxDpAbekwwOw9yiqMwl2QA==,type:str]
+admin-password: ENC[AES256_GCM,data:VVEs6UmQymD7bhc2DQ+ghuE=,iv:LRht/bByPtiCjkazc19NRIwbXzZclEZYtwCeXJfFMfQ=,tag:ig1bUcDNr+1wsDHoeBfMvw==,type:str]
+db-password: ENC[AES256_GCM,data:1QXmkEs6ECbf8NcoMcmgF4mLOYo=,iv:xKiTicbmhJaLajgN2taL+VR+H0ky1fHI3e79I0D6IdA=,tag:Whd7VdtjC7sYqC24XGEqBQ==,type:str]
 sops:
     age:
         - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqdWFvNXF3QXpnbjFsbHhn
-            dmdnRmRwWnpkUVlRSHlEZXdXT2FoeVVVejFNCkZ0UGp5YWZ2TThEUnZPOVNqVjJR
-            S0lXSGxSSFF3ZWhUM2NMWW9MZUszZnMKLS0tIEowWHo5SUFMMDFNY1lWY3NuNnJN
-            OERJZklLT1RnSDc4VjdaQ0F3cVRTaGsKYIfYSv4In5YiGs2/KWX1oPqOoiUxwVUl
-            jROG2UecsSjhKq6XdX+KVYmcSKhy1ljPjHaL+t3MmSNE6+jJpMpDvQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdHZRckgvZXZwRUdFZTNt
+            WFlNU0YwWncyNC9aZEFIT0hRRU5uYkNLMXdvCmgxM3NHSnR0THFXZUw4amZnSi9t
+            dkgrZDloUVo5NkZ5eDdPNUxaTi84NncKLS0tIGlmWDBiMjJUWWxsU1ZzWTZYL2dm
+            c25XZ0NKbUtuNHBjeGJ6YWVDTndaMXMKKHqfuydqSL65wdpHcyug8eg0p1VPMSuz
+            VeNu16pPCtTtStuGl4f2ciOVMaGCNbjY3XySRzZQKUNciZVTfat5Ow==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUNzZSWE1NcTR1blQ5TWxH
-            N0k2YWNOdTA4WHZXQ3VlTHpWNVNuRm53S3dzCnZOR0gyWTVzams4SjdCZVpSMjdL
-            S2dqZTcvb3VtVE9JUWVlVU1QL1NaZ3MKLS0tIHdUZldWZWdIZ01VUWxLeEJDNmY0
-            aEV2U1JMaTFYRldjc1kwNHczd3gvM1kKEytPjCdNTG+8SFnQxh50XKfjAxa1xn0t
-            D3dj6yMfIfkgnp84pI9PY5hBweHrEcdeUwhPrkNY8dRuiShv4o4xTQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0YzZ5am1lWGFaeVBxak5P
+            bVdSWHZTU1pkR3U0b1hvMVIvZUh3MnNpbkNJCm8wMmNUVzZ2U01kc3crTGliZG5u
+            MHpKVDZaZEt3dkJ3cVRVREpPQXFXUlUKLS0tIGdwSjNXUm4reENLUFRhMlNWQ0Yw
+            Ykw3QjBoQ2c0c3U1dWs0OVpCajBnYTQKtU/a24mNe+yo91QvFs2qHC2HR5tft9ny
+            d0RnFNYSaxgFWbV+Hs3vzBQUFlq0CzhfZzRR/rUcRfnrd+krlXThRQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:57:04Z"
-    mac: ENC[AES256_GCM,data:LKIihGyIcUImsmRWgPhWQRBeaFiXdWgaMwlif+FPNdmy/LSRlwIqIN8KzwuMu1zAlNvl1SVOVZL7SgRe9rZHax5pIn+Qrb5B+cuFPZTyvl24VBlJ+l29x182CKhRnT1RDDA9D7do+y8bG+rjyJ6u5d/yYcMAYIH9+I4fS4uERQw=,iv:23M4i1uCpQzfWZIp2c4gGThOCGotS3eajdjItlAwh2Y=,tag:MoD7LbWCu5EGxPeliRDinQ==,type:str]
+    lastmodified: "2026-03-12T14:08:13Z"
+    mac: ENC[AES256_GCM,data:E7YknH7WIh7zhZElq67jPRyt1dfjQDVWvrcIMtHbkRG/d6xQhgeJY9HwWJaotfrlCx3tpxO0zi882/ACVoogY+8f3l8jCCOEp+e20X3qDmbEOrRLsl8+mRnDiyJFAXULqJvAHEr5yJnYNxXXvVzOSpTOe+ECgedCJ4fgRU58c0k=,iv:FZt+eF6OLW+98FVxe7TFdpCWSvMwwXWKdudccgMJoKo=,tag:lpCIsC85JDG7p6xyxJnk4A==,type:str]
     encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    mac_only_encrypted: true
     version: 3.12.1