44faf74b61
The ExternalSecret had a stale Gitea URL (192.168.8.148:30322 — old local IP) and runner tokens were never populated in Vault. Update the template URL to the cluster-internal Gitea service DNS, and store the registration tokens in Vault at secret/gitea.runner_token.