Add SOPS+age secrets pipeline

apps/sops-secrets-operator/values.yaml

@@ -0,0 +1,15 @@
+# Values for the upstream sops-secrets-operator chart, nested under
+# `sops-secrets-operator:` (the dependency's name in Chart.yaml).
+#
+# The operator needs the age *private* key to decrypt SopsSecret resources.
+# That key must never be committed — it's mounted from a Secret you create
+# by hand, once, directly on the cluster (see docs/10-secrets.md), the same
+# kind of one-time manual bootstrap step as Argo CD's own install.
+sops-secrets-operator:
+  secretsAsFiles:
+    - name: sops-age-key-file
+      mountPath: /etc/sops-age-key-file
+      secretName: sops-age-key-file
+  extraEnv:
+    - name: SOPS_AGE_KEY_FILE
+      value: /etc/sops-age-key-file/key