fix: replace placeholder Secret with ExternalSecret via bitwarden-login

manifests/gitea-runner/secrets.yaml

@@ -1,16 +1,18 @@
-# FIXME: This Secret is a placeholder only!
-# Greg must generate a runner registration token from the Gitea web UI
-# (Site Administration → Actions → Runners → Create Runner Token),
-# then store it in agenix and wire it up to populate this Secret.
-# The Secret should have key: token
-#
-# Until this Secret exists in the cluster, the gitea-runner HelmRelease
-# will fail to deploy.
-apiVersion: v1
-kind: Secret
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: gitea-runner
   namespace: gitea-runner
-stringData:
-  # FIXME: Replace with actual runner token (managed via agenix / external-secrets)
-  token: "REPLACE_ME_WITH_ACTUAL_TOKEN"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    name: gitea-runner
+    creationPolicy: Owner
+  data:
+    - secretKey: token
+      remoteRef:
+        key: 11419680-5338-4f19-bdd9-b422007046af
+        property: password