feat: zero trust SOPS key isolation (deploy-k3s#32)

- Add test-key (age1wtzdf8...) for shared test environment
- Enable mac_only_encrypted: true in .sops.yaml (SOPS >= 3.9.0)
  Allows adding new YAML fields without decryption key
- Re-encrypt all 10 files with mac_only_encrypted metadata
- Strict isolation: dev-key ↔ *.dev.enc.yaml, prod-key ↔ *.prod.enc.yaml
- test-key can only decrypt *.test.enc.yaml (not dev/prod)
- Add dev/verify-sops-isolation.sh — 33-point verification script
- Keep dev/prod files with admin+dev / admin+prod only (no test-key)

Verified: 33/33 isolation checks passed

Co-authored-by: XoR <xor@benadis.ru>

kargo/credentials/dev/git-creds-infra.dev.enc.yaml

@@ -9,28 +9,29 @@ type: Opaque
 stringData:
     repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
     username: Kargones
-    password: ENC[AES256_GCM,data:lzaZLTkmA68DadpquacJNc6CMxwv3wOlWh6Ze8e23F9lzFKw3oB5gg==,iv:9EZUg6DSUFnNddOaiB2oIfNYhaOKKkrP9Hkf+5OGcLk=,tag:rr6ej2x87mquQbXiBM7+Ow==,type:str]
+    password: ENC[AES256_GCM,data:PYZtFr/Yui75oe0M6Bll8eU2qpGf5IygIHUA6L35s5IHPVxUIrbWcg==,iv:NIODrxhD1mTWxq74NoZWZpC9zQQxL3NYIxxO6lAhp8Q=,tag:tcrF1xcFKZBmWFWr7z7/sg==,type:str]
 sops:
     age:
         - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCeGdkaVJiNWE0Q0xWbTVT
-            dkZDN296VXJUMktMVUZ2U3FyeUwvVzBSaWc0CmRlWFpLdTlCNXl3eEtKcDRrUzhV
-            SG9KdkhlSTg0SnZwK3BvS0hkT3FjbjgKLS0tIDA2Y1lic053ejR0UWZUekZ1Y1JK
-            c2llUmhKNTRjaW1zQ3AyZzUvR1VRUG8KuFXq5pbpEEZd3P/E5bD0FCuSOIuGCsJL
-            bUx6VucI1zZF0DbXjzr28FsxqSJW4GiCpDscj1LGQIZa5jvj8aWMXA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMY3BSZUZwVytjYXQ3KzB6
+            K0JRdnVwTllMNGJYS05vc1c5R01UdzdUN3owCk80TmJ4RnZIMHU1U0FOWEVoUkZa
+            OVRLVytwMlpPZFRNcS9wdXZKaWlhWncKLS0tIElDZGgwOFdkNCsyUGxEU0tYYjE1
+            YS9TY09rdXRkRmV4bTVOZFBqeitLazgKZCOAKyuKeRN8X89FOdHaT94phsIAZCwk
+            bFPckh5jGn1QKVNYdvLmyPAFO55ehsMA/JRl42YdzCsDSifvuufcCw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRlh5SXdkTmZOVUdXc21N
-            aXNZaDhydXA3dUU4OHlidmViM2xUQU5rNDF3Ck9iditWSWcyaWoxNTVTRzN5Y0ZU
-            c21BT2R6U2lxNkh6cU9kdjFSRUVjUWsKLS0tIHBwWGI1R2p0TTg1amFRM2FlYVQx
-            Q2lIZDJ0ZkliWEtiVGd5eXIxMjB1OGMKeK2iTyPBrcIWByU9QXZ3Ora7gylwC66g
-            diGbcUF5ER7mUt0KEILTwuMkTUbhy1F5zLYB7p4e49YdY2O8mz51SA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UTlsc1hiRWN3UUVwTzhU
+            MkZteGhveUsxaFJ0djd4RXpTYjl1S2l3cmlNCi8zRStWVUVPMkJ0ZVBnZDROdEc4
+            Tk9LOTN5Y3krQXp3Tk9GLzVBVkMrdzQKLS0tIDNkcmpRSkpHMXdvQVZBU3J0UCt0
+            amFPNEpGbUxZb0luNEpaZlJuWnFkd3cKHs6+l+Kapohsah+Zhoob5DXXchw2C5kc
+            cl6KK79gbxN4pTTCmWJHfaiXuohRXol3Z1km6QWrEaNC9IGF6nmGJQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:58:02Z"
-    mac: ENC[AES256_GCM,data:dzyW+dAsjPDrZQ3EWNnhLWfd9DSmRVSp1Qrm+nx4qFfsRoS5y61jnkhVyupq2OUVsuUTuePIAqmZQI16HD0TTMJIN9UKPdW2sEj/DGwdBXqcJRs6mvJlv79Jh2VlzJdJSpZf/YhCBVIVThZqrWBI1T1jPdN1gaJ0ov6cSAqYjPU=,iv:MMhdUthu2nUFJOkxXz00xXMiH7tit7sNejU/aXuQOmY=,tag:+NSHR9T4wlpJaBH5ZdxhvA==,type:str]
+    lastmodified: "2026-03-12T14:08:14Z"
+    mac: ENC[AES256_GCM,data:q+gHiqfdUmeOdaHpuj42fHXnrrHY3elE2cDTqlU9+s3atsnDEERoFx/1qJvqlOCYmvHM4h3wyAQHPB6hIt205RKHQJ13TxTEzGWkgrk5eThAolu4w9Z6Vd7Ni0Sv4dyNtdPlkj1N0907sACCBMUelLIpD6acf8jL9+n6E+xIgsE=,iv:1ZsjWgntw6iHuQZYhSm9KrWs36D6FegsweLHwYmxHQM=,tag://6dNpONbhDQUKbaUT8/gA==,type:str]
     encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    mac_only_encrypted: true
     version: 3.12.1