fix(sops): set encrypted_regex to data/stringData and configure DNS fallback resolvers (#33)

### Summary of Changes

1. **SOPS Secret Encryption Scope**:
- Configured `encrypted_regex: '^(data|stringData)$'` in `.sops.yaml`.
- Re-encrypted PostgreSQL and Umami secrets so `apiVersion`, `kind`, and
`metadata.name` remain in clean plaintext.
- Prevents Kustomize controller panic on encrypted metadata during Flux
GitOps reconciliation.

2. **Reliable DNS Fallback**:
- Added standard fallback DNS resolvers (`1.1.1.1`, `8.8.8.8`,
`77.88.8.8`) to `03-cleanup.sh` and `bootstrap-cluster.sh`.

ci/k8s/apps/umami/secret.sops.yaml

@@ -1,24 +1,24 @@
-apiVersion: ENC[AES256_GCM,data:vuU=,iv:zpYbCxqVLtsR3u32TCmrWuR2Tsh+MkJU2svi1blu1hI=,tag:JmXQYWJ0mxITglxfofJ6NA==,type:str]
-kind: ENC[AES256_GCM,data:9rg7//dU,iv:Dv5Ezu6iR1vQO7LAaRbp02KAPpYayJlnVINCbmYJTqc=,tag:9/ORm++3ai4cWGVkzksEtw==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:4uR03R2de95TVff9IQ==,iv:EVKzFEFpV+JI26z2rrq26Bzm+IvwF+Fz5pbeuGJ69no=,tag:iPkp4SW2n2qxD8jRGzn/Pw==,type:str]
-    namespace: ENC[AES256_GCM,data:nZ3xeCc0z7c+RYrcjA==,iv:lY7t/JpPAZ1XkjfHAyYdCKQPlOwy43L6tU+cPMsMuzI=,tag:1YDH4AZqFEJdki2AV33mRg==,type:str]
-type: ENC[AES256_GCM,data:nSMCLir6,iv:RpZRrH9jlHUv3w+O8w93xAdL313BAFNKSbV20Tx6YfE=,tag:C7yQ9C92tzHbfDjuSjVY9Q==,type:str]
+    name: umami-secrets
+    namespace: com-ermnvldmr
+type: Opaque
 stringData:
-    APP_SECRET: ENC[AES256_GCM,data:bDL4s2ZTQO8SZnqOHs7AbDZKcXEeEOP0rgq2x6XbNbJeQiyPpT586AXPlxFG2Evj8isayPh4B5Xv9BGWGHgQkQ==,iv:HnRwLJdinB15xScCAj7Mr5iBZZ74e9qwU58t3OTb87Y=,tag:ZXIA7KqtpkTxPBta85R8FQ==,type:str]
-    DATABASE_URL: ENC[AES256_GCM,data:lNFfvx22Etq97UyLG192//h4iD2LWyz+y2kFUcEPNhiBt63lcZCngzyNRJtp2F9XqHJOCUyzciTZMyP96jQIRNJFusg1BZG/gWrs/eV/40x6aWn8VTZLQdU382DUa7adINo02//w1Jyj35Jlvk7Lx7TycplkFqc=,iv:1Uq8rH6Ih869Udz4Vrjh6k8miue7tMgD7N6Oba7oZmY=,tag:XwtAQvkTphqA5Rckbm9RQA==,type:str]
+    APP_SECRET: ENC[AES256_GCM,data:aaoXs+F/lXvP0kHNZ+Uoo0HB4GnYZ9raYOgEbRwIrkSFGSoTuv/PkvSOYDppDLKxhNMDLhbgTJwEMrHGZzIewQ==,iv:W3u4QPKetqBDSZdsRte5zYeFy9SlRmPw4ORGFTGzN7A=,tag:bkVyGsKgcMGODY4Chpv+8Q==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:XbAdd3hNGS+n42XgTQF5rg7AiBkbjFGHOeuTROLgjmIMCUh7afPSheFn6v8bSaibePYJdQBrdFK+kYW9o7aFYhe8Hz1cneATNP0PoQaqlxSrcnM+DeHQzFTC+98ACkskLgk27heZFjCdRr3A4LVRdcet/+2q/8U=,iv:UwxEwPeYdPYrvi30qso4yCZ6m20geusN+P7DOjowjEw=,tag:bQB7OupyNnCjn0INB8T7sg==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBISnVmeG1oYndJNnNWbkZT
-            YVloQk5YelFrbHZWZm9RTk9VTjNKU3hPazFzCmY2MUYrM1VBc2E0ZHRZWURZcjJa
-            S0VjUS8yV3JISzRWREhxSFBaQ3BoU0UKLS0tIFRpTUpPUWlzaXBETjZjSzZhd1lr
-            NWoxZS9DaGtMSEs5dXdWVElHUjdaMWMK9r5mAJfgvpGGiluxhcO2/uhb8ZhJMIkt
-            N6pnLh/OwrOL7JiTqiERTQHSKrltFuZKuZKqoNCo0dYDzfRCpWHcDw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZ2h6THNGTnY2ay9Tc2Q3
+            S0xxU3NEZGx2TS9MRFdqZDV6aEtUalBWRFVJCjZMd1VCdkg1cjIxSlliZXNRQnU0
+            YnMzTXJOSGdsUDUwNkdDdWZWcmRaZjgKLS0tIDdEOFoyOWtvZytITys4bk9ra082
+            WmFIREJMS1BVU0o1VnZHby9ZSHN4cGcKReBW7hdTPH8eGqPzEYkOdrIUYm9a1jOi
+            du/1fhAyhjimbbCNdOSuSjrSP8QX6mxwPoDb1dVlKi0Rah5VGW+HWw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
-    lastmodified: "2026-08-23T10:41:12Z"
-    mac: ENC[AES256_GCM,data:t4K0VskS20T0fSokIx/7/YwnYAYpD7hTQIS2jNDtv3QtISZ24skrCLA1qMEa6uDqtXHFLa9VsRbH219gu6tTzA/84e547TEfKMSX+LAlv/T6yzxL8Sje9PuZo1wA7alViHtzu0NHKUava3dKzYkJF4sh8tIr/8CGpCvYIIWHXvA=,iv:lLxua+PsyjS0YlLkh5BO0/ZrdiKgktCT/b52IqGiQVU=,tag:kwn6j0XLfaricKEfe6Y6Gw==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:QZOb7pmfDpEn2/kefQQ8k4WJQddlF5jKTY5EaSm1Srt33DceELA3NPJMiozAzpbIEoLR6a7oR6C7zofHHVCBmYcRd2DSHqafW3EOtOt5noiAmkGOQKEWH7aSRFJqcy5EmBcVihd81Z1CkJI6MPcBeQvY0BlVqgm2YqX2QQBolgI=,iv:TB+Rn3ffe4HzVHjk2+XaKaLG1+589AmBhPjOXXKWHto=,tag:zfKVYP1h/4sWXSVtuhQH8Q==,type:str]
     version: 3.13.3