feat: zero trust SOPS key isolation (deploy-k3s#32)

- Add test-key (age1wtzdf8...) for shared test environment
- Enable mac_only_encrypted: true in .sops.yaml (SOPS >= 3.9.0)
  Allows adding new YAML fields without decryption key
- Re-encrypt all 10 files with mac_only_encrypted metadata
- Strict isolation: dev-key ↔ *.dev.enc.yaml, prod-key ↔ *.prod.enc.yaml
- test-key can only decrypt *.test.enc.yaml (not dev/prod)
- Add dev/verify-sops-isolation.sh — 33-point verification script
- Keep dev/prod files with admin+dev / admin+prod only (no test-key)

Verified: 33/33 isolation checks passed

Co-authored-by: XoR <xor@benadis.ru>

kargo/credentials/dev/git-creds-ci.dev.enc.yaml

@@ -9,28 +9,29 @@ type: Opaque
 stringData:
     repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
     username: Kargones
-    password: ENC[AES256_GCM,data:m9CZFhTHwaX6TrpGtbAynbI7eiprSrhCVVtST6fWiduFP55/EWtx1Q==,iv:iAjeVVakD8SZWhaEBu7JVR1YL2UGzYNBoy1W13M+Jwg=,tag:ABSswqyDhJG8+zlu8dWrgg==,type:str]
+    password: ENC[AES256_GCM,data:swl5u5LpFYVKjZcuWaG+QNWLR02gi9dyXlD2yqkcFLTRpWMD3lvSfA==,iv:pixqI9FQMdQzlvs6Mmhp8DvAbofGby5zHISH3bjLwh4=,tag:PHfTfXN12bHrQCJPFW3xJw==,type:str]
 sops:
     age:
         - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHOWI4eWZxOERjRHVhV1VI
-            MVE3WDErejZrNzBaRnVHK280dXI4WThxR2tvCmVzbE1HR1MzcEgybm8vUVVSOWJY
-            VlVvREl4NVRDRElHVHk5aWpnVkVhNW8KLS0tIG5FOXRwRy8xakFvaVlBTXF5OXJJ
-            aHFlbWh0Ym1NWEswbFM5N01JRGtGMUUKyjiN+bK0+6PLc/LG/dozgrAhB4PLcZmV
-            JVtxrSZWV6RQOuvc/HUw2yhO3dJldYqWauX+7ZOy2o1JACdPe9ixdQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVc3JLYnBtWFZ6NGRhNjha
+            WW1xNW1JUFRTc1dXM203bUdPRmRWWGF6R1RBCmExN1N3STUxVGpIZmtDMzZXMWkz
+            Y2pJUklqM1YyWVlFVVpEQkQ2R0NRUE0KLS0tIDF0cXFYcllWYUlWQStMVU83MEd6
+            cnJia1lOQ21FTjJ3SkxJSDRFaExrNDAK4zDNcqeJsjZYR+b5qX97n+Asa8riugnL
+            kPuBWyO/R8XjvuNfMZb9njt6gSgX1u6aGyxL3rHXbNhvdRmmGfZIdg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHWU9JLzdwbDI1SDJ3MnlE
-            YnlRQkdzWExpa1FGNjArSHFCamc2bWJnbjBBCnlkQlVEQVNDTXMvZ3NWRzhyT2lM
-            R0FpVUdleUVUcVVrTnRxQjVnSFo3S2cKLS0tIG1MZ0hYdGJpdTJ3WWU3MU1WeWFr
-            cklvSldLdW5ERDF1aW95dDlxOUtGbDAK7uoTP8idcEM8rQ7rRashsbzc9f4S7qI9
-            Bl87wLgMAFYfFO41cwSqhMY+gr7HRkDQq65CWo8HpQjMMlneC72jVQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaC9kb3ZIVU5zNitJWWVy
+            Ump3MFFBTUQwVUhCQ01PVnUxVVhxT1NaWGpNCnVvSUFNVlU3SDNHK3p6Y0pKLy83
+            eVdlWmRqNHk3ZWNuLzc5ODZXOEN0S0EKLS0tIFRFdDh1cVRxK0dNTEQxallBc01j
+            RmI5SHF5SE5GRTNudGZ6K3hheVZiZFEKXy6rNacjL40EiukSU/SxeiBUMyWe3EVe
+            LvyrP+d7GoC6+wix6IglQUTdV6YKjI0oCJOews+5wNveqc2SMMLlcw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:58:02Z"
-    mac: ENC[AES256_GCM,data:OYJAnGhgB0sOC2KEgse7ZYMkrvrRNsMWqVQZM29VbhPbvp3s3GMmJPROPydsjvm6OE4EIi0C6ry2h9pGoRY5IApw6+tSXVmrlr3oQIjkGqimJVdJ0oBSwEYtZ6gNKpsn1I7ZthXCHBfZmmESkYiTJj8ogdXxNLIqydIuITengpI=,iv:IpBxWcDeGUD9ucIAVjY3Ojc0wd63nWDPDIcH8OtvJY8=,tag:yDZ8d9E9dufB/iGTk71t2Q==,type:str]
+    lastmodified: "2026-03-12T14:08:14Z"
+    mac: ENC[AES256_GCM,data:sy/CRatnNB8U7kMFfkqZlrB9Xs0bD7kmHu5EOGJHxtaMAE+Wql7D7yFh78mJuGJk8snmsGP2xK1Pkqcx38HwWUBbw8kqoT6X45NGn99uCT11sMvz/Kyp98PWVc+IFhqwnNyAfd76gvIkKx4CqkXbxCsxdQaw3RMYEArdGWPufrE=,iv:CUJTpRjXAraVTeBFh7Z4fB/Wk4cXdYnBXpRGJETSm2A=,tag:p+W7xx9thkAkA2iPIDuqjg==,type:str]
     encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    mac_only_encrypted: true
     version: 3.12.1

kargo/credentials/dev/git-creds-infra.dev.enc.yaml

@@ -9,28 +9,29 @@ type: Opaque
 stringData:
     repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
     username: Kargones
-    password: ENC[AES256_GCM,data:lzaZLTkmA68DadpquacJNc6CMxwv3wOlWh6Ze8e23F9lzFKw3oB5gg==,iv:9EZUg6DSUFnNddOaiB2oIfNYhaOKKkrP9Hkf+5OGcLk=,tag:rr6ej2x87mquQbXiBM7+Ow==,type:str]
+    password: ENC[AES256_GCM,data:PYZtFr/Yui75oe0M6Bll8eU2qpGf5IygIHUA6L35s5IHPVxUIrbWcg==,iv:NIODrxhD1mTWxq74NoZWZpC9zQQxL3NYIxxO6lAhp8Q=,tag:tcrF1xcFKZBmWFWr7z7/sg==,type:str]
 sops:
     age:
         - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCeGdkaVJiNWE0Q0xWbTVT
-            dkZDN296VXJUMktMVUZ2U3FyeUwvVzBSaWc0CmRlWFpLdTlCNXl3eEtKcDRrUzhV
-            SG9KdkhlSTg0SnZwK3BvS0hkT3FjbjgKLS0tIDA2Y1lic053ejR0UWZUekZ1Y1JK
-            c2llUmhKNTRjaW1zQ3AyZzUvR1VRUG8KuFXq5pbpEEZd3P/E5bD0FCuSOIuGCsJL
-            bUx6VucI1zZF0DbXjzr28FsxqSJW4GiCpDscj1LGQIZa5jvj8aWMXA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMY3BSZUZwVytjYXQ3KzB6
+            K0JRdnVwTllMNGJYS05vc1c5R01UdzdUN3owCk80TmJ4RnZIMHU1U0FOWEVoUkZa
+            OVRLVytwMlpPZFRNcS9wdXZKaWlhWncKLS0tIElDZGgwOFdkNCsyUGxEU0tYYjE1
+            YS9TY09rdXRkRmV4bTVOZFBqeitLazgKZCOAKyuKeRN8X89FOdHaT94phsIAZCwk
+            bFPckh5jGn1QKVNYdvLmyPAFO55ehsMA/JRl42YdzCsDSifvuufcCw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRlh5SXdkTmZOVUdXc21N
-            aXNZaDhydXA3dUU4OHlidmViM2xUQU5rNDF3Ck9iditWSWcyaWoxNTVTRzN5Y0ZU
-            c21BT2R6U2lxNkh6cU9kdjFSRUVjUWsKLS0tIHBwWGI1R2p0TTg1amFRM2FlYVQx
-            Q2lIZDJ0ZkliWEtiVGd5eXIxMjB1OGMKeK2iTyPBrcIWByU9QXZ3Ora7gylwC66g
-            diGbcUF5ER7mUt0KEILTwuMkTUbhy1F5zLYB7p4e49YdY2O8mz51SA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UTlsc1hiRWN3UUVwTzhU
+            MkZteGhveUsxaFJ0djd4RXpTYjl1S2l3cmlNCi8zRStWVUVPMkJ0ZVBnZDROdEc4
+            Tk9LOTN5Y3krQXp3Tk9GLzVBVkMrdzQKLS0tIDNkcmpRSkpHMXdvQVZBU3J0UCt0
+            amFPNEpGbUxZb0luNEpaZlJuWnFkd3cKHs6+l+Kapohsah+Zhoob5DXXchw2C5kc
+            cl6KK79gbxN4pTTCmWJHfaiXuohRXol3Z1km6QWrEaNC9IGF6nmGJQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:58:02Z"
-    mac: ENC[AES256_GCM,data:dzyW+dAsjPDrZQ3EWNnhLWfd9DSmRVSp1Qrm+nx4qFfsRoS5y61jnkhVyupq2OUVsuUTuePIAqmZQI16HD0TTMJIN9UKPdW2sEj/DGwdBXqcJRs6mvJlv79Jh2VlzJdJSpZf/YhCBVIVThZqrWBI1T1jPdN1gaJ0ov6cSAqYjPU=,iv:MMhdUthu2nUFJOkxXz00xXMiH7tit7sNejU/aXuQOmY=,tag:+NSHR9T4wlpJaBH5ZdxhvA==,type:str]
+    lastmodified: "2026-03-12T14:08:14Z"
+    mac: ENC[AES256_GCM,data:q+gHiqfdUmeOdaHpuj42fHXnrrHY3elE2cDTqlU9+s3atsnDEERoFx/1qJvqlOCYmvHM4h3wyAQHPB6hIt205RKHQJ13TxTEzGWkgrk5eThAolu4w9Z6Vd7Ni0Sv4dyNtdPlkj1N0907sACCBMUelLIpD6acf8jL9+n6E+xIgsE=,iv:1ZsjWgntw6iHuQZYhSm9KrWs36D6FegsweLHwYmxHQM=,tag://6dNpONbhDQUKbaUT8/gA==,type:str]
     encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    mac_only_encrypted: true
     version: 3.12.1

kargo/credentials/dev/git-creds-test-env.dev.enc.yaml

@@ -9,28 +9,29 @@ type: Opaque
 stringData:
     repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
     username: Kargones
-    password: ENC[AES256_GCM,data:pGwKoR6eurha3ATmL0XP01DTK3qXCxAV3SdFYmNFokKMZI+VuzZ/GQ==,iv:DKVdeBRQS+HjPkHftJZZuXf7yB+I18Ae3iK+7L+hZQ0=,tag:/K6twgUKTNrn6s1rDTAeQA==,type:str]
+    password: ENC[AES256_GCM,data:BnToDVLq7wjdMDFL+y+OM6pJlIQibKr9hdLrA4o2hsCDMAxqgGrgdw==,iv:KDJMguvXjehgLfhb9E8Uw3zViT8gLegPGuoQfZsVwvc=,tag:PyZ5CwhnXC71pisaJYBt0Q==,type:str]
 sops:
     age:
         - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTk5seDNiR2dRcXRRclJZ
-            UlNuRXZGd3ZMTDNsaHVrYUtnUmsyNk1IVkJFCmo0Y0pwdnlsay9qcy8rakk4ejBF
-            VHAzbmRObUFVVVpZN0JraHRlVmhhNW8KLS0tIHNXd01OUnVxclRXcE9iNFNzZS9S
-            UlQzRnlSb2F0Y0J0eVdZN1BSelRrSWcK8V99m3Hh2mOm9csGG42k4FIeFbQnkXIr
-            w3elSENAib0rFz7Uewpn1VD3yjFL7SVv33bVOEuM3KlHDtUnF6fuuQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWMW1YOE1QRStGVzBtTEo5
+            Q2lkWWxUeE1wT0t5OE1oSklhYmpaREVBWVdFClJ6NWVEUEtFV3pYanZHejZGbldi
+            NExoejZUd2ZFS3FMcHZvMUs1R2c3OG8KLS0tIHFOVmtDQ0pBRXBza25qNVNwOEZX
+            SVZCRWszaG5qS0crc1ZYUmRwMkNlNTAKJqmqt9sZG+zk3zbd9f9zbRtVEAO7soF6
+            AMFdNc6nrDY9KXOCVRwYn+bbcgWr1Gfzv4PF5Kjzp4ApQ/0aA7wLwQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOS05ZanNzMWRFRG5EUlNq
-            WmtLUHpHRE0rWXRuVXRLRDFiRDZSZmdEc2lnCmMrbHRxRUhIWDFkaTJlekxrckxj
-            V3ROU25aOVZGVzVUY3IwRlhwYWhBWEUKLS0tIHZCS1ZobFlqQ2NZSUt3N1VSV2l4
-            SmVWWDRhckRxek1jRFpPUnIxb0QxaDQKmkVXDqP0tjaWo/fkdqrIatV/bhyQt9vb
-            Rzz21KATjKow6VtekA3FVOVchlDsaYDLkhuLI69I1lIYqR99ovS+8w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTT216YjBGNnhFUVExbkdG
+            YmNONnU0SWp0aHNvd0YzK202K3owa0c1b3prClRYZ2RFeFUrTzhDdFFNbGxnZURu
+            UEZpY3lVbjZVam5adVJUbThXc0RYUjAKLS0tIG1qR3EzVjlmUE5DREdvbFMxbVRP
+            UDVSQ3lwcExOS1NwSkZwZk1iaXJacHMKrGWH26/kRCWuBjVLfqqVS4stxW/huyqa
+            u/QpRmKO0oFrX0u9l6DfHOaVUUgSao1p8nvEDrHKTLe574d8bayyQA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:58:02Z"
-    mac: ENC[AES256_GCM,data:CDESJXzhctA4WexUb2hP6ykWkRCWUsgIYHOSmRnHUlyf6Pd8uF43Bl/+ZHWhE6SLWf3LKGMOKSU60Qkh1aSH+Z9BqaiKa3dL0MIQx4yXRe9NzS/mEki4IsuQi27AZ6BKD93tznyVKbCAzxmyP1jRhbRNIKBA2dWoQAITX1w2vvA=,iv:l8JZK3a17DfIn3llapKnUZH7SRNCte5MNPZzjtPJbxA=,tag:rEcarIr7UhsV+THixTUiKw==,type:str]
+    lastmodified: "2026-03-12T14:08:14Z"
+    mac: ENC[AES256_GCM,data:20Te36BK8FWJ1jiUrMMl7yDhOJwCw/jGpoJbP5t5NjelJDlx9ygC7LtOkgck1FpaNvhsuroJWbOzojpkzRZKLrIUhpoiIaXpliZ3O5aNpHKFbJsf6tJmEY1cy7VaosF40f0RvH3RxWbjr5jWNGSoi5yKBcFZ32aCK6g2ToXpCHs=,iv:eGWVRv1que1NbfqAluy6UP3jLXpTWtDsFPDws3Addjg=,tag:kU/WSR26mDMdOz/i8Edf7w==,type:str]
     encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    mac_only_encrypted: true
     version: 3.12.1