chart: disable externalSecret on this cluster

The block describes a ClusterSecretStore named `vault` with HashiCorp-style
key/property refs. This cluster has `oci-vault` — OCI Vault via
InstancePrincipal — whose provider addresses a secret by name and takes a JSON
property, so those remoteRefs do not translate as written. There are no
ExternalSecrets anywhere on the cluster, so the path had never been exercised.

svcforge.secretName still resolves through targetName, so the deployments and
the migrate hook read a Secret named svcforge-secrets, created out of band from
~/.config/svcforge/secrets.env.

This is a deviation and the comment says so. ArgoCD does not manage that
Secret, so prune and selfHeal cannot touch it, and it is the one part of the
deployment that cannot be read from git. Restoring the intended design means
adding oci_vault_secret resources to oci-k8s/infra/vault.tf and repointing
secretStoreRef at oci-vault.

deploy/chart/values.yaml

@@ -81,9 +81,30 @@ otel:
 log:
   level: info
 # The DSNs are pulled from Vault by external-secrets into a Secret the pods envFrom.
-# No DSN is ever a chart value, a ConfigMap key, or a CI variable.
+# No DSN is ever a chart value, a ConfigMap key, or a CI variable. That invariant holds
+# either way here — what changes below is only who creates the Secret.
+#
+# DISABLED ON THIS CLUSTER, AND THIS IS A DEVIATION, NOT THE DESIGN.
+#
+# The block below describes a ClusterSecretStore named `vault` with HashiCorp-style
+# key/property refs. This cluster has `oci-vault` instead: OCI Vault via InstancePrincipal,
+# whose provider addresses a secret by NAME and takes a JSON property, so these remoteRefs
+# do not translate as written. There are also no ExternalSecrets anywhere on the cluster
+# yet, so nothing has ever exercised this path.
+#
+# With this false, `svcforge.secretName` still resolves through targetName, so the
+# deployments and the migrate hook read a Secret called `svcforge-secrets` that was created
+# out of band:
+#
+#   kubectl -n svcforge create secret generic svcforge-secrets \
+#     --from-env-file=~/.config/svcforge/secrets.env
+#
+# ArgoCD does not manage that Secret, so prune and selfHeal cannot touch it — which is also
+# why it is invisible in git, and the one part of this deployment you cannot read from the
+# repo. Restoring the intended design means adding oci_vault_secret resources to
+# oci-k8s/infra/vault.tf and repointing secretStoreRef at oci-vault.
 externalSecret:
-  enabled: true
+  enabled: false
   secretStoreRef:
     name: vault
     kind: ClusterSecretStore