fix(ci): remove kubernetes-deploy workflow that leaked secrets to logs

The workflow ran on every push to every branch and deployed nothing.
It echoed the raw Vault login response, the Kanidm API token response
and the OIDC token response to the job log, dumped the environment,
and configured kubectl with --insecure-skip-tls-verify.

Deployment is handled by gitops-update.yaml. Docs updated to describe
that flow; T1 marked done in the cleanup task list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/2026-10-08-1026-pre-feature-cleanup-tasks.md

@@ -30,13 +30,18 @@ before new feature work starts. Companion to the Go rewrite tracker,
 
 ## Fix first
 
-- [ ] **T1** Remove the secret leak in `.gitea/workflows/kubernetes-deploy.yaml`.
+- [x] **T1** Remove the secret leak in `.gitea/workflows/kubernetes-deploy.yaml`.
+  Workflow deleted on 2026-10-08. Still open for the owner: rotate the
+  credentials and remove the now-unused repo secrets (see below).
   - It runs on every push to every branch and deploys nothing.
   - It echoes the raw Vault login response, the Kanidm token response and the
     OIDC token response body to the log, and dumps the environment twice.
   - It uses `--insecure-skip-tls-verify=true`.
   - Delete or disable the workflow. Rotate the Vault AppRole secret and the
     Kanidm API token if anyone else can read the CI logs.
+  - After deletion the repo secrets `VAULT_ROLE_ID`, `VAULT_SECRET_ID` and
+    `K8S_CA_CERT` are unused and can be removed. Old job logs still contain
+    the leaked tokens until they are deleted or expire.
 - [ ] **T2** Confirm the fee rates for 2026-09 onward.
   - `ADULT_FEE_MONTHLY_RATE` ends at 2026-08 in `scripts/attendance.py` and
     `go/internal/domain/fees/fees.go`.