fix(sops): set encrypted_regex to data/stringData and configure DNS fallback resolvers (#33)

### Summary of Changes

1. **SOPS Secret Encryption Scope**:
- Configured `encrypted_regex: '^(data|stringData)$'` in `.sops.yaml`.
- Re-encrypted PostgreSQL and Umami secrets so `apiVersion`, `kind`, and
`metadata.name` remain in clean plaintext.
- Prevents Kustomize controller panic on encrypted metadata during Flux
GitOps reconciliation.

2. **Reliable DNS Fallback**:
- Added standard fallback DNS resolvers (`1.1.1.1`, `8.8.8.8`,
`77.88.8.8`) to `03-cleanup.sh` and `bootstrap-cluster.sh`.

ci/k8s/apps/postgres/secret.sops.yaml

@@ -1,25 +1,25 @@
-apiVersion: ENC[AES256_GCM,data:XU0=,iv:0HP8xIgbhQzBxIAsUBnkxi7wWMuyedsyOMC+zO9Fvw8=,tag:H7rYCSkBAog0ut4eXP9dWQ==,type:str]
-kind: ENC[AES256_GCM,data:8nu6otux,iv:FiHwWJpQDxF/LS5lfqYsH3Fk3YCEp+OZstpmvgGI5s4=,tag:tsiQtQH/W3SQ1Dk7ov65NA==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:2PmmHyt4B6+tnYUb7R+zbA==,iv:Ox++aI1pcNWSnaYZRsto9hh1X9rrX9nb/Ra+MeDbAKI=,tag:kYfWd1QRRyEgb6RZ24OYGA==,type:str]
-    namespace: ENC[AES256_GCM,data:85gh76P2r88Y7KHsoQ==,iv:GPDJiMPubS/0VsIBlCKpYMrX2XWa+U/3pG3pHBIXFnI=,tag:HLMCW7lh9pQV3elfkSsBBA==,type:str]
-type: ENC[AES256_GCM,data:7QaM8COE,iv:2oml3iRBnXZvlGqAJEXBg3BR/hq7gw0f7+UoMFsxOtI=,tag:e7Ky0fjons6BQdsF/ynknw==,type:str]
+    name: postgres-secrets
+    namespace: com-ermnvldmr
+type: Opaque
 stringData:
-    POSTGRES_DB: ENC[AES256_GCM,data:+7B7L0Y=,iv:iIqQkEL4DWIcb4HkfURJeMe9NUVLCHumc1GcHwIzwLQ=,tag:xWLqm+WBWvm8F0MH71WtMA==,type:str]
-    POSTGRES_USER: ENC[AES256_GCM,data:L+H5q14=,iv:3M0Vp0+HYOeQAUxPcjZEnY2KUTr26ehVjEMjdF5nYWE=,tag:z8KhOSWQnsLxpkernIrx+w==,type:str]
-    POSTGRES_PASSWORD: ENC[AES256_GCM,data:dwrnI8QNbyWuTIIW1CsUvlLu9xQR6qXYygBVtbc213VAVX3A6nh8lA==,iv:qN2ApXdPHviuAamJ/4vf6FCA0BiIQO4QKeI+HPg/Msg=,tag:kNfLE4lgCT0T6CUx8EW6Dg==,type:str]
+    POSTGRES_DB: ENC[AES256_GCM,data:ChvCjVw=,iv:97n6Q+WzbVOwvRZGGHAfBXQDPx5mnUCSsUNs76xV1p4=,tag:mZLUB3q0UR+9ovqmndFrRg==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:V1q4xfE=,iv:RPHHhWLkdmKHG6CMubrw8JUfHlDXnL0x76JEo05O+mo=,tag:PV1YEyqeb8bTF/98SL1uKQ==,type:str]
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:aBWfOuPyeAEo0vf8fAYzlTfXooPKX6FPbHkpBQ+4zve0KBQh7/yvjQ==,iv:FB/fZoLirzPTbDIel7wRECQP85sFFlIdyoljrilbMxU=,tag:tTZz1PHhaLtmPO9Pg8Vh5g==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRdnhpb2RkZmpBZVJ6ZHdO
-            dTlDZlk5SHoyeDNjdjJVOG5xa0ZuZGhNSUE4ClN2a1puUm9NTGdXMS9xVDFNN3Vi
-            YTNkemRBR2ZqMTI2Q0VsSU90OXNGNTAKLS0tIDkyRWRYODJKcEExa0JlVVVwaEtH
-            QlFhL0gxZ0FxdVpaZmQ3Q3F4c1JITk0KZxdLfBhiF9i8knoqfx1nE3K5dPtZ8sJ/
-            2LBK7CS0o7BfyLjeBxehboLT2sGv2JFDr/zgVfGo6KPfzuFNDVrYrA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRXIvMEpaWU1XNjV2OFpp
+            Z1lYb25kOFVVaXlRYkdzSmxWbmxqaXR6TEhRCnF0M2ovRVNmdTU3WnNOcy82OExV
+            YXNjZVJrbTdXQWJxMjQvNEdZNlBwcjAKLS0tIEEzczNmZjFwT1d2aXVKV1Bvdm1Q
+            UnZoNVNCYjJiYWd6WlNobGEyUGh5NmMKkUTDkYlNkXH8DegvBT7ymkL7h1B9x77N
+            IxeZI5mp8vc347/620+cbMMr2+aELlgs9/bJhUcLRm0Bv8UDVLOleg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
-    lastmodified: "2026-08-23T10:41:12Z"
-    mac: ENC[AES256_GCM,data:geILRWPP2+bbSsS0JNQ2FiMSRbYeRWI6eYuKZKvNT8k21xVnVhiW/6+eK+oC1mGlxY5t/MNypdTAzaeNQaB+eMNUDfqDa2YhOcmP2KjabCb1hWqOAm675G83ZMerBZZb5CgwswYNF0HAsYIX6mr1o4zhQjmMhE/0I6eovwmYX9k=,iv:MwCKb/ENFXnG3Plof4krdu4DXkxlmXMMbebX0MXasyc=,tag:FtSRZeffdlpQb44f7z/flg==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:tvk/U3XXcRrJCI8I0yUID6jwnlPc1ftiOHs8uxqrbAtLN3KelHGy94fWyxYMoboHeh5R8pNErIxk9EsJok2wjrSENZWMXueVZHtMUWlyC4DhTDAVVYhJ6sL85f6cMiHWDNSlTk4AvfWvdvE6b/0coZ7Rybgw5kNeW6Stw4CSbu4=,iv:sfiOamzam1e0t01KaGHSsnZOBpBGEi3K0KK50QDmaFs=,tag:Ul6xShhIdvTuX3qS6Uo4Kg==,type:str]
     version: 3.13.3