feat: zero trust SOPS key isolation (deploy-k3s#32)

- Add test-key (age1wtzdf8...) for shared test environment
- Enable mac_only_encrypted: true in .sops.yaml (SOPS >= 3.9.0)
  Allows adding new YAML fields without decryption key
- Re-encrypt all 10 files with mac_only_encrypted metadata
- Strict isolation: dev-key ↔ *.dev.enc.yaml, prod-key ↔ *.prod.enc.yaml
- test-key can only decrypt *.test.enc.yaml (not dev/prod)
- Add dev/verify-sops-isolation.sh — 33-point verification script
- Keep dev/prod files with admin+dev / admin+prod only (no test-key)

Verified: 33/33 isolation checks passed

Co-authored-by: XoR <xor@benadis.ru>

kargo/credentials/dev/git-creds-test-env.dev.enc.yaml

@@ -9,28 +9,29 @@ type: Opaque
 stringData:
     repoURL: https://github.com/Kargones/deploy-app-kargo-private.git
     username: Kargones
-    password: ENC[AES256_GCM,data:pGwKoR6eurha3ATmL0XP01DTK3qXCxAV3SdFYmNFokKMZI+VuzZ/GQ==,iv:DKVdeBRQS+HjPkHftJZZuXf7yB+I18Ae3iK+7L+hZQ0=,tag:/K6twgUKTNrn6s1rDTAeQA==,type:str]
+    password: ENC[AES256_GCM,data:BnToDVLq7wjdMDFL+y+OM6pJlIQibKr9hdLrA4o2hsCDMAxqgGrgdw==,iv:KDJMguvXjehgLfhb9E8Uw3zViT8gLegPGuoQfZsVwvc=,tag:PyZ5CwhnXC71pisaJYBt0Q==,type:str]
 sops:
     age:
         - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTk5seDNiR2dRcXRRclJZ
-            UlNuRXZGd3ZMTDNsaHVrYUtnUmsyNk1IVkJFCmo0Y0pwdnlsay9qcy8rakk4ejBF
-            VHAzbmRObUFVVVpZN0JraHRlVmhhNW8KLS0tIHNXd01OUnVxclRXcE9iNFNzZS9S
-            UlQzRnlSb2F0Y0J0eVdZN1BSelRrSWcK8V99m3Hh2mOm9csGG42k4FIeFbQnkXIr
-            w3elSENAib0rFz7Uewpn1VD3yjFL7SVv33bVOEuM3KlHDtUnF6fuuQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWMW1YOE1QRStGVzBtTEo5
+            Q2lkWWxUeE1wT0t5OE1oSklhYmpaREVBWVdFClJ6NWVEUEtFV3pYanZHejZGbldi
+            NExoejZUd2ZFS3FMcHZvMUs1R2c3OG8KLS0tIHFOVmtDQ0pBRXBza25qNVNwOEZX
+            SVZCRWszaG5qS0crc1ZYUmRwMkNlNTAKJqmqt9sZG+zk3zbd9f9zbRtVEAO7soF6
+            AMFdNc6nrDY9KXOCVRwYn+bbcgWr1Gfzv4PF5Kjzp4ApQ/0aA7wLwQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOS05ZanNzMWRFRG5EUlNq
-            WmtLUHpHRE0rWXRuVXRLRDFiRDZSZmdEc2lnCmMrbHRxRUhIWDFkaTJlekxrckxj
-            V3ROU25aOVZGVzVUY3IwRlhwYWhBWEUKLS0tIHZCS1ZobFlqQ2NZSUt3N1VSV2l4
-            SmVWWDRhckRxek1jRFpPUnIxb0QxaDQKmkVXDqP0tjaWo/fkdqrIatV/bhyQt9vb
-            Rzz21KATjKow6VtekA3FVOVchlDsaYDLkhuLI69I1lIYqR99ovS+8w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTT216YjBGNnhFUVExbkdG
+            YmNONnU0SWp0aHNvd0YzK202K3owa0c1b3prClRYZ2RFeFUrTzhDdFFNbGxnZURu
+            UEZpY3lVbjZVam5adVJUbThXc0RYUjAKLS0tIG1qR3EzVjlmUE5DREdvbFMxbVRP
+            UDVSQ3lwcExOS1NwSkZwZk1iaXJacHMKrGWH26/kRCWuBjVLfqqVS4stxW/huyqa
+            u/QpRmKO0oFrX0u9l6DfHOaVUUgSao1p8nvEDrHKTLe574d8bayyQA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:58:02Z"
-    mac: ENC[AES256_GCM,data:CDESJXzhctA4WexUb2hP6ykWkRCWUsgIYHOSmRnHUlyf6Pd8uF43Bl/+ZHWhE6SLWf3LKGMOKSU60Qkh1aSH+Z9BqaiKa3dL0MIQx4yXRe9NzS/mEki4IsuQi27AZ6BKD93tznyVKbCAzxmyP1jRhbRNIKBA2dWoQAITX1w2vvA=,iv:l8JZK3a17DfIn3llapKnUZH7SRNCte5MNPZzjtPJbxA=,tag:rEcarIr7UhsV+THixTUiKw==,type:str]
+    lastmodified: "2026-03-12T14:08:14Z"
+    mac: ENC[AES256_GCM,data:20Te36BK8FWJ1jiUrMMl7yDhOJwCw/jGpoJbP5t5NjelJDlx9ygC7LtOkgck1FpaNvhsuroJWbOzojpkzRZKLrIUhpoiIaXpliZ3O5aNpHKFbJsf6tJmEY1cy7VaosF40f0RvH3RxWbjr5jWNGSoi5yKBcFZ32aCK6g2ToXpCHs=,iv:eGWVRv1que1NbfqAluy6UP3jLXpTWtDsFPDws3Addjg=,tag:kU/WSR26mDMdOz/i8Edf7w==,type:str]
     encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    mac_only_encrypted: true
     version: 3.12.1