Prevents CI/CD from overwriting manually patched K8s secrets. Secrets should be managed separately (GitHub Secrets / sealed-secrets). Root cause: 03-secrets.yaml contains CHANGE_ME placeholders, causing pods to crash with "password authentication failed". Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>