feat: distribute docs app key to Namecheap root

[xnoto]

Summary

• add tfroot-namecheap to the existing chart-updater GitHub App private-key Actions-secret recipient list
• make no encrypted SOPS value changes and expose no secret material

Consumer impact

tfroot-namecheap is the only current OpenTofu reusable-workflow caller missing this recipient and now has a companion caller mapping in tfroot-namecheap#2. Existing root callers already forward the same secret.

Delivery dependency

The secret is not present in tfroot-namecheap until this PR is validated, merged, and its environment-gated main apply succeeds. Merge only after the existing branch-protection recovery PR #48 has completed its intended reconciliation.

Validation

PR CI plans are the validation authority. No local OpenTofu, decryption, or apply operation was run.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-namecheap"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "tfroot-namecheap"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.