Provide & verify the Flux read credential for the new source

[jorisjonkers-dev-agents]

Context. Before flipping the root Flux source to JorisJonkers-dev/homelab-deploy, the cluster's Flux must be able to read it. Behavioral parity is already proven (0 behavior-changing diffs vs the live tree).

Depends on. Branch protection (M1) in place on homelab-deploy.

Steps

• Decide the read mechanism (deploy key / PAT / App installation) for the new private repo.
• Create/rotate the secret the root GitRepository will use and store it (Vault path documented in homelab-deploy).
• Candidate read proof: point a throwaway GitRepository (or flux create source git --url ... --branch deploy/production in a scratch namespace) at the new repo and confirm Flux reconciles the source successfully without switching the real root.

Acceptance

• Flux can authenticate to and fetch JorisJonkers-dev/homelab-deploy deploy/production; candidate source shows Ready=True. Old source untouched.

[jorisjonkers-dev-agents]

Prerequisite for the source flip (issue #22). The homelab-deploy repository is private; Flux must be able to read it on the cluster.

Acceptance criteria:

• A Kubernetes Secret named flux-system in namespace flux-system holds credentials with read access to JorisJonkers-dev/homelab-deploy.
• flux get sources git -A shows flux-system with Ready=True after the source URL is changed (or test by creating a temporary GitRepository pointing at the new repo before flipping the live source).

Recommended approach (GitHub App installation token via Flux provider):

# Verify the existing secret can read the new repo before flipping
kubectl create secret generic test-homelab-read \
  --from-literal=password=<token_with_contents_read_on_homelab-deploy> \
  -n flux-system --dry-run=client -o yaml

The flip in issue #22 reuses the existing flux-system secret name — update that secret's credentials to have read access to JorisJonkers-dev/homelab-deploy before applying.