1Password secret references for local Kubernetes secret manifests

[smebberson]

Adds support for 1Password secret references (op://) within Kubernetes manifest templates, so projects can keep secret manifests in git without plaintext secrets, resolving them to real values only at compile time.

Related PRs

• ras-rsc#449 - adopts this in ras-rsc's local environment (pins this package's beta).
• Docker build secrets support #100 - Docker build secrets support (independent; both touch bin/lib/c-kc.js, so whichever merges second needs a trivial rebase).

Notes

• Any .yaml.tmpl containing op:// references has them resolved with op inject (file mode) before the template is rendered, so template placeholders never interfere with references. Templates without references never invoke op.
• type: secret services can use stringData (plaintext, one value per line), which is base64 encoded into data within the compiled manifest, just as Kubernetes expects.
• Before resolving references, the cli authenticates with op whoami (only when references are present) and halts with a friendly eval $(op signin) message otherwise.
• Compiled secret manifests are written 0600 and removed after they've been applied (c kc start, c kc apply), or when c skaffold dev exits (new c kc secrets-clean command, quiet via -q). This only applies to the local environment; beta and production are unaffected (they will move to Google Secret Manager).
• c skaffold dev now halts when manifest compilation fails, rather than continuing into skaffold with stale compiled manifests.
• README and CHANGELOG updated with the template format, its constraints (single-line, unquoted values), and the compiled secrets lifecycle.

Verification and testing

Verification

• Before this change, a project's local secret manifest (e.g. ras-rsc's manifests/local/site.secret.yaml) held base64 (i.e. plaintext) secret values committed to git: base64 -d on any value reveals it.

Testing

• With eval $(op signin) in the shell, c kc manifests compiles secret templates into .compiled with values identical to the originals (verified 18/18 fields against the previous committed secrets, both in .compiled and applied to the minikube cluster).
• Compiled secret files are 0600; other compiled manifests remain 0644.
• After c kc start / c kc apply, compiled secret manifests are removed; other manifests remain.
• c skaffold dev keeps them for the session and removes them on exit (including Ctrl+C), via the c kc secrets-clean -q trap.
• Without an authenticated op session, c kc manifests and c skaffold dev halt with a friendly signin message (and skaffold never starts).
• Non-secret templates (.yaml.tmpl without references) render exactly as before; plain .yaml secrets are still copied verbatim (beta/production/devspace unaffected).

Deployment

• After merge, release v6.1.0-beta.1 (tag only, beta dist-tag): npm version 6.1.0-beta.1 -m "Version bump to v6.1.0-beta.1." && npm publish --access=public --tag beta && git push --follow-tags.
• Promote to v6.1.0 (rename the changelog heading, npm version minor, npm publish) once this PR and ras-rsc#449 are approved.