fix: add kustomize merge annotation to secrets that exist in base install.yaml

argocd-notifications-secret and argocd-secret are defined as empty secrets in
the upstream install.yaml. Without the merge annotation, kustomize errors on
duplicate resource IDs when the KSOPS generator also produces them.

manifest/overlays/production/argocd-notifications-secret.enc.yaml

@@ -1,27 +1,29 @@
-apiVersion: ENC[AES256_GCM,data:flg=,iv:83F3hv2qP3ASBB0lQ7g+QjjoXk0KMFn5V2IvHH11yOk=,tag:Q3rkQD0aKmwqpYL+TSYJfA==,type:str]
+apiVersion: ENC[AES256_GCM,data:uDM=,iv:5zJ9zeBF9HcDpeW5pa2V8DKod7it0QmpJbPYbC2C5l8=,tag:VG3DWeTa0BrkAyy4IEPZgw==,type:str]
-kind: ENC[AES256_GCM,data:Jk69Vv9H,iv:rtddSB8OSwWR82N6f43rz57H0oTMjzqq3aODCg3v9rU=,tag:iFHeJUsAlro6hgT8tupdJg==,type:str]
+kind: ENC[AES256_GCM,data:jSg5p1A0,iv:IQJbzH8kwB8MDtvPODxnVjyHPDJZsmk7pJAsxQgXvIk=,tag:2Z/s7DoQHq1PWCzYyxPdkQ==,type:str]
 metadata:
-    name: ENC[AES256_GCM,data:ewPTx2Lq00hgzYyeVa2+oM6LgFQDK8gg5hLL,iv:1J1Wy46Hvr6mp85q9fv99B9cfsTuExjvpoTDB/8myrY=,tag:DaC/cJ7vkrKMu6Oz7/DJjA==,type:str]
+    name: ENC[AES256_GCM,data:nTkL/kAqE63tkjbiJfMAi/FVktLgoXtvBMXU,iv:bjBX8Zw3jkNOXNqKcX1QiKAESRvVAlmy8iKPYWm9bXs=,tag:ZwkFTOOTSq1tx5G6VCCzwA==,type:str]
-    namespace: ENC[AES256_GCM,data:S6wkoPiJ,iv:Cy5HLamnoj1np9bt7ODeGUTucH2PQSxTOPgJl4QfPsQ=,tag:pEepbzA1a0CTmi0tuFA1kA==,type:str]
+    namespace: ENC[AES256_GCM,data:6wXXTlFW,iv:MNaxNMCC37T4cwcH7QvluctCD4hso/LTYZPGfc3Dl8s=,tag:W81+Q/KyX0mIrfbk/gNwKg==,type:str]
     labels:
-        app.kubernetes.io/component: ENC[AES256_GCM,data:8d2YjLFBp3VPl2zeuxJfOzm788lCAZ3d,iv:qiSqfljW5Hm+Rj5uQ2wSNPMlpwpGIMb8McBMh1LZGaw=,tag:1o+ZMmq3RL3BzUFB6h42nA==,type:str]
+        app.kubernetes.io/component: ENC[AES256_GCM,data:mIBkwyxqAgtQYHpKpvscsSOgGpEweCYX,iv:4Dq0AnGByGTtAUY5dgiRfpdcnyoqSHnLnyYJZ/mJTvM=,tag:qI7ETqJhfQtZ/1uJP4/LVA==,type:str]
-        app.kubernetes.io/name: ENC[AES256_GCM,data:MFLQilzVzVtXvL/aNV+w4vV4FtS5m80VO34HxkxFyQ==,iv:BNIT3ZRHdzumBUjJdmH/mDihAM5NnyE0HQfwznuJiCk=,tag:rKzodfi6OxO81RK7ZqXaFA==,type:str]
+        app.kubernetes.io/name: ENC[AES256_GCM,data:fJliyNDZ4Rfa6D2QIKLKcmxGk7Pv59DNGLKqjVC78g==,iv:ziFzw+V3crWBdW5Z9mIpRUpuY1Y8xk0fPMrFfHuuxvk=,tag:6OF9t2bn/temQMEhrahnuQ==,type:str]
-        app.kubernetes.io/part-of: ENC[AES256_GCM,data:CbEvLB1O,iv:jummL2+j0lnceAtETXX3h7tS38JXzZxLA79u7Fp7IqA=,tag:jYyQkKOJE4nVXmU1MiviQg==,type:str]
+        app.kubernetes.io/part-of: ENC[AES256_GCM,data:lCtXuuKf,iv:XaxeTocZimiU0q0QbDW0N66aKUFX5XHUnSaI95YdLQk=,tag:gEEpdYJ2wG95StL4Dr3J1g==,type:str]
-type: ENC[AES256_GCM,data:gAPVO9VZ,iv:3s1IB/K0wdApZlrxdaDBRDf3bBkU9GtCBDy3tZCBlMw=,tag:ZT848ft/1YThZw6ikdrNzw==,type:str]
+    annotations:
+        kustomize.config.k8s.io/behavior: ENC[AES256_GCM,data:CNXKM2k=,iv:CMLFoADwTlFdkL79xzF1wmqxWbtOM6h9GAfwniZz8Iw=,tag:xBpOixAte8XFalWYOTkbyg==,type:str]
+type: ENC[AES256_GCM,data:OCyLelpq,iv:Y1DFcVAFKY4X1gXuNyjciZfFNpfYUByk9qGudC90ebM=,tag:IS9Eqe5NwaiwjOfCNzKFpw==,type:str]
 stringData:
-    gitea-token: ENC[AES256_GCM,data:/6S07DKQX8woDMwLfr/YMRX5RZkyuwZQneGaI26VTy25DKNHNxWOIw==,iv:qWC5ngTvJjFt9EPqhwZWeTtSAKKnGJuCnViN+MtJ09k=,tag:FosylS/Zn08jf39o/M8I6g==,type:str]
+    gitea-token: ENC[AES256_GCM,data:HtJ71iZcM9EBnYbzbpwnpdx8ErpEYxP+ud//klM7z1DllyaPpSy5JA==,iv:t2IvB5MsFEDC8XkDnKxACj6USz1z9cAwzNYMvpH2a/4=,tag:65N0OlkQgQt+74vI0MEDcQ==,type:str]
 sops:
     age:
         - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZEJDem1jRUVsakpiNWFV
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2STlCQXN3dkJRZ2s2SGNl
-            MHNIOGVHd2l2eFAvbThjNzhCeDh2KzVXTWdVCld6VnRQWGVmd2hWTTJqUFQ1L3Zt
+            Wk44bHpjVUhSNmV1MEV1cjB0S3cyR2F5YkVZCk9sZmNaT2kzVVRjZEFyMkdIb1ZX
-            Zk5XTURvUVRqSmswVitDdnprcUQ5MlUKLS0tIHpSaWc1NDZKNVR1KzFlaVN0QUVh
+            amY3bFpLOCtMSFdNZnQ5azVwcEdxbm8KLS0tIGo2WU82eVMzUlFtc3JUSkduQVZB
-            bmVLNHpyMkhHVmhZMjhDaFdad2l1UDAK2uMzseBvBCX3XaO2vrQYkVsnAqg+H2ri
+            dVNGRTNyTmNjUlVBRy9sOVV3STBZMTAKukXeDMUklESDFF17XezNj1lkNg68Pkng
-            l99fLmj7cj5psvULsz48Dmhxmj8tEWT3m7XDEIYqTq0WR9OAvHLLIQ==
+            oFtBnxqsTDNN5WWIR/VWor8GQlA6uGKymIsEtIsMsKtvxCSnOf3+TQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
+    lastmodified: "2026-04-19T22:41:25Z"
-    mac: ENC[AES256_GCM,data:ZDE0axhBDCtkYXatCpf6og2s0PS3AYrJ31iQTMcdl5eQio7Q6a1YmvNAaQGW9z7EyrJvE2FXlP6scK52kDOB2cXFsXWC6/ZCgpW9Xjz8jxjzfXjycJdBEynTND2bnhXaYRIyZJBi5IeH/kmwc+o3VQvidqrhNHNjZIFq1cL516M=,iv:xATIsjbkpCWKht3/jYmvXA5zhajLNog39mUwHTneM1I=,tag:dIHuobyi09HBjHRXDc4jug==,type:str]
+    mac: ENC[AES256_GCM,data:lD3x8ysEmZQwKzzFOAgdmmnxM5qhqm0iMwlxW/vcYBh6MyMGqcFC0qOCZMd1eo7EbyNYKdBpZrJvp+QXGQWjebPc8sqX0PgGPbWmuk/SqMo0ZMJnre4C59SSIUo9DdQhWRGZoOrbZ7xl20bV/HCab1ACqeoamBNXow7eeeaosKE=,iv:Igy0kZnu98uTpjJyvAOhrj3AC9H7eyU1I++6kpFtNY0=,tag:oWa4jnOTMTfRp28TMUvLFg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2

manifest/overlays/production/argocd-secret.enc.yaml

@@ -1,27 +1,29 @@
-apiVersion: ENC[AES256_GCM,data:6pI=,iv:SOiwZYQ9ibt5cxUPsjFGKicXsE3s0aioI+yra2RRYek=,tag:/VH/FB3MOb4TRbE9U7YH6A==,type:str]
+apiVersion: ENC[AES256_GCM,data:0Dk=,iv:MBWmnkHji7VXquHkJIuzpSTHDsTmN6OuvtGq1BIyeyM=,tag:JFW/1HOaByUdx+gXE/z5gA==,type:str]
-kind: ENC[AES256_GCM,data:yBPlCctq,iv:mCLCcSPsRTvqHUl/M2bm092l7U1vBdOw7vI884Tl5Do=,tag:RzBsEWGOQP5E915j1qluAA==,type:str]
+kind: ENC[AES256_GCM,data:3xOGEszG,iv:LHUezglyWj7/zCdJtk12iBZoAO3fL7J3iN5fJgirXVU=,tag:ByU5f2TfIcPy1dvyQeiTRA==,type:str]
 metadata:
-    name: ENC[AES256_GCM,data:MgRKogbwDU3w4zoCOQ==,iv:oxGyw6J1/QFN0dM+qVzhnBKAgiUE1IlfIOnm8pdONK4=,tag:7RfvAzZLaBGbxjNTxmu5tw==,type:str]
+    name: ENC[AES256_GCM,data:hzVHdyJNqK4L763uoA==,iv:frXtAV6aGIKKtdBfESHTla24kqJ4tWadJyPOniZLQY8=,tag:U/7mylj9q+tdn3zy71CG0w==,type:str]
-    namespace: ENC[AES256_GCM,data:XN8z9Tns,iv:6dr4MqhKNOO6TUEmcKxwrzOdI39383UsfC6h9LM0ziU=,tag:EPmtKFsB7kAuTwyG26mkEQ==,type:str]
+    namespace: ENC[AES256_GCM,data:ChUXhzu1,iv:Ha5cKWFVdk1vByysEpg1weZ4APJL8mCXUhySoKrvrFM=,tag:K0rAPI1cCKAa1s3grwk20A==,type:str]
     labels:
-        app.kubernetes.io/name: ENC[AES256_GCM,data:svBm8BdGpGQRm1K0wA==,iv:gqf17yYOr13LeEJ4uA85evTYo9M5cLn/pX01bJEzgU0=,tag:PeQ7I9drbhFbcmncsfxIOQ==,type:str]
+        app.kubernetes.io/name: ENC[AES256_GCM,data:goqINPH4t07kdDGySQ==,iv:681ojmz83BAMcpDBZ1/Q7vh+HKGCaCsSnFUTXAmeX+E=,tag:fcjXO+BB5NNGMUPTmRODow==,type:str]
-        app.kubernetes.io/part-of: ENC[AES256_GCM,data:zLxaf5eR,iv:86lK8tESmNUu+3naA7N74bFHJ2CQTi57ctvFmI09h5U=,tag:Otztl8aFAaon0Mrg+D6dfQ==,type:str]
+        app.kubernetes.io/part-of: ENC[AES256_GCM,data:SLtRJ/GB,iv:4eHOqd/0FHjdNC5pAg1rRU4RM9GH6V4/28g8AcWfT5M=,tag:Y4O58iWeUi9zOrn4loNrlg==,type:str]
-type: ENC[AES256_GCM,data:81RzU4Gg,iv:A0PYn779KKH1abtaeJd2mNG5I4gzM34xPJfWxPzZDQg=,tag:Uo/8mRYAEV5QgvObBh9JCA==,type:str]
+    annotations:
+        kustomize.config.k8s.io/behavior: ENC[AES256_GCM,data:gU3w9y8=,iv:6Ktt02hCJtAC4WycmLl7/kHMPoAnDa7OSX32teOfcRA=,tag:xAz3NkBxInS0HU80kcCRog==,type:str]
+type: ENC[AES256_GCM,data:kkRWsfy7,iv:x8tBB4mO2Yl/By53IPgadKsmtbLXyitXs885tk4+bOU=,tag:b6yYiS1d17D8kFSE29uc8w==,type:str]
 stringData:
-    admin.password: ENC[AES256_GCM,data:CGKjrnQaoGLTSXYbtdxJM6MzMR3bJT8s/7EMoprAI7+4t7Dl3GMMOg7dsCcJ6l+42bUWoTNIIRIS6wYW,iv:UPxi2Fc0jtpVDJpFP657zvZ8Qk55o4eekkuTVjpWJ8I=,tag:EW+aQVirTcABMWqtMDV3xg==,type:str]
+    admin.password: ENC[AES256_GCM,data:n/F+kRLtOct4ZfZ8+5eQjwjLDjT6paDUSYKupAcN41+wdvdYHXEKG7xh92N5lycUYlb2FKCQUvQtQIx0,iv:zL7koqBy7j2N68Vg8MU7k7rL3OfgmS578WZIyJ3Uk+w=,tag:xjdVzaky5cR/6lP4MvlqJQ==,type:str]
-    server.secretkey: ENC[AES256_GCM,data:JtlnOyf6eJcHOhP0jAtTL5kT9iqJtu0fiozybnpxGZAhYVQl6vB62R4WlIQ=,iv:x0AU+L3CD1e8sgwD4lC+8XxmzQ4lH7QG8o2FZqI6XKk=,tag:z2gZ2nRofFD0sEYAxRhYVw==,type:str]
+    server.secretkey: ENC[AES256_GCM,data:U8HySATKld5H+1qiY3l+p5h3VAOnA2HIbdoGU4e+rxJc0D7WVBJc/s9qqoI=,iv:nAVWcA1lBIruOKkJ39/E/2eYqFKj8KEmk8GaXYNJ2e4=,tag:XGSl3SpVbNcSeEMaavfbVA==,type:str]
 sops:
     age:
         - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPR0FlOE0wNDFKcm1nUUFk
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQm1Bd3VIU2NRU0NQbEx0
-            WFB0WWtiMlZmeXJwdStYOW04aDQ2QTVYaVV3ClZ6dFlNanI1WVJxMlM1cXB5a3dW
+            elRJTC93ZGNBeFVIZmxmL2ZOUmUxa3R1WVhZCkhOZnJGOVdQM3A2ZGNFTm5HK2tW
-            Y0Q3dHd0M0ltRWp2bTNQbGtuakUzTGsKLS0tIElsMmRGM3AzZU9NZGRDMUhvSXY4
+            NEsrbnI5alFiY2xUUGlLWjV0ZFBidm8KLS0tIHBTSFlyMkpJR2JZY0lOcS9NQzJC
-            VUlLT2JCSVpWWVY5MVhWUlI4VWpiZ2MKC/Z6MSEhX0iqd8a8zpgPAKFiUiuNHW6k
+            VmtYNy9FOW5zTEtGNVFhclJXejBWejAKMNd9TpbVKcMWCCbXVIIqrw2lalsiIH3Q
-            3u+7+kBsO4Ghww2qhlIzP+AuhEULHTLGoFjePmZNauWTikGmXgHpZw==
+            yZoCIszujQMpomaHtPgRYSBdfqa2/WWgxNO0jE9EWEClW6awOce1/w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
+    lastmodified: "2026-04-19T22:41:25Z"
-    mac: ENC[AES256_GCM,data:bfMCYfasYyS6yiJCSn3UQQreL0idoc+1eSqR9Z1vNW7lq7t0vQWy2oW6v8ds+oQH+6ODg5cQT+u4IX7btR8C6ffq84z4Abw0K5ul3POJtkWGvjtnJt2EF2Dvg+q497gUK2LOZR/fFdXSImoTDedFqf/DBV+0DL0QHru/UKIuOOA=,iv:5Ks3iLG6tAT92s+3CINe8jv20qoue8NYmI9Z5WqNmbs=,tag:et5xcTjzIagB4feoYmoDBg==,type:str]
+    mac: ENC[AES256_GCM,data:6U5XlgHdnojCNXZGjP7bmm8MKQGgA9CJNuR+muJ87D6HQxaiCv3vii6WDf4bSkKoewZ8/NX5+ISPg+ntKra9dS5Ggr7QFT09xzL4wuDVm5StPZcUwbYeJnrGuMd0cGhHbTSCJEFnFDHk+pb4SMa3KojfNJHmCMIvzLAjmEv9eWU=,iv:PbU58ASf1ltuaoCYsg8nCk1jnlC51zmuhMoIuqnvec8=,tag:wltrBLCx3bI5vnKBUusIPw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2