Use data instead of stringData for capmox-variables Secret

stringData is never stored, so kubectl apply reported "configured" on
every run and the capi play was never changed=0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-09-27-0058-mgmt-cluster-ansible.md

@@ -110,3 +110,28 @@ full playbook run re-applies it via the `inspector` task (`--apply-rbac`).
 
 **Worth noting:** the `.claude/settings.json` allowlist picked up four one-off entries approved
 during this check (`export KUBECONFIG=…`, three exact `kubectl … logs` commands).
+
+## Step 3 — Idempotency check (in progress)
+
+### Full run: `Apply provider manifests` always `changed` (2026-09-27 10:35 CEST)
+
+Owner's full `ansible-playbook mgmt.yml` runs kept reporting `changed` on this one task. Found
+with two read-only commands on the VM:
+
+```bash
+ansible mgmt -b -m command -a "k3s kubectl diff -f /opt/lab-mgmt/capi-providers.yaml"
+# rc 0, empty — nothing actually differs
+ansible mgmt -b -m command -a "k3s kubectl apply --dry-run=server -f /opt/lab-mgmt/capi-providers.yaml"
+# secret/capmox-variables configured (server dry run)   <- everything else "unchanged"
+```
+
+Root cause: the Secret used `stringData`, which the API server folds into `data` and never
+stores, so client-side apply's three-way merge sees it missing every time, sends a patch and
+prints `configured` even though the stored `data` is identical. Fix: template writes `data` with
+`| b64encode` values. Expect one more `changed` (template file + last-applied annotation
+rewrite), then `changed=0`.
+
+Also from this check: the widened inspector RBAC was not applied yet (`get nodes` still
+Forbidden), so no clean full run had completed before this fix. `clusterctl` v1.12.11
+darwin/arm64 is installed in `~/bin`; `clusterctl generate cluster lab1 --infrastructure proxmox:v0.9.1 --target-namespace default --list-variables`
+lists no `PROXMOX_*` credentials, confirming `clusterctl.yaml` only needs workload values now.