feat: distribute chart updater App key to kustomize-cluster

[xnoto]

Summary

Adds kustomize-cluster to the chart_updater_github_app_private_key recipient list so the repository's new rotate-opencode-openai workflow (kustomize-cluster pull request #200) can mint scoped makeitworkbot installation tokens.

Branch protection on kustomize-cluster main allows only the admins team and this App to complete pull-request merges (restrict_pushes in gh-protections.tf), so the App token is required for that workflow's unattended auto-merge. The App installation is organization-wide, so no installation change accompanies this recipient addition.

Type of change

• Infrastructure (OpenTofu root or module)

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan both succeeded
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — one-line local.secrets recipient-list change; no generated files touched

Impact and rollout

Plan scope (from the plan check): 1 to add — github_actions_secret for CHART_UPDATER_GITHUB_APP_PRIVATE_KEY on kustomize-cluster (sensitive value redacted in output), and 2 to change — pre-existing topic drift on github_repository tfroot-twilio (removes tfstate) and www (removes cloudflare), reconciling live topics to the declared topics_by_repository map; not caused by this change. 0 to destroy.

After merge, the environment-gated apply distributes the secret. No change to App permissions, installation scope, or any other repository.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints — this change references the existing SOPS-backed field only
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes — rollback is reverting this recipient entry and re-applying

Agent disclosure: change, branch, and this pull request were prepared by the makeitwork OpenCode agent at the owner's direction, following the chart-updater runbook's add-a-source procedure.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "kustomize-cluster"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

  # github_repository.repositories["tfroot-twilio"] will be updated in-place
  ~ resource "github_repository" "repositories" {
        id                                      = "tfroot-twilio"
        name                                    = "tfroot-twilio"
      ~ topics                                  = [
          - "tfstate",
            # (5 unchanged elements hidden)
        ]
        # (36 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # github_repository.repositories["www"] will be updated in-place
  ~ resource "github_repository" "repositories" {
        id                                      = "www"
        name                                    = "www"
      ~ topics                                  = [
          - "cloudflare",
            # (5 unchanged elements hidden)
        ]
        # (38 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 2 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "kustomize-cluster"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

  # github_repository.repositories["tfroot-twilio"] will be updated in-place
  ~ resource "github_repository" "repositories" {
        id                                      = "tfroot-twilio"
        name                                    = "tfroot-twilio"
      ~ topics                                  = [
          - "tfstate",
            # (5 unchanged elements hidden)
        ]
        # (36 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # github_repository.repositories["www"] will be updated in-place
  ~ resource "github_repository" "repositories" {
        id                                      = "www"
        name                                    = "www"
      ~ topics                                  = [
          - "cloudflare",
            # (5 unchanged elements hidden)
        ]
        # (38 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 2 to change, 0 to destroy.