duynguyen
c2c265c898
Drop .env/envsubst/bake-hash-into-values.yaml flow entirely. Chart's configs.secret block is removed for good, so the rendered manifest never declares admin.password/admin.passwordMtime. Password hash is set once directly on the live argocd-secret via kubectl patch, and survives every self-heal sync since ArgoCD never owns those fields.