fix(renovate): decrypt values BEFORE renovate edits them (retract broken post-bump round-trip)

The prior postUpgradeTasks command 'sops -d ... && sops -e' was wrong:
Renovate has no preUpgradeTasks hook, and postUpgradeTasks runs AFTER
Renovate rewrites the file. These values.yaml are SOPS documents whose
sops.mac authenticates the whole file, so editing a plaintext image.tag
invalidates the MAC and 'sops -d' then fails (data-integrity error). The
claimed decrypt-after-bump therefore could never work.

boot.sh now decrypts every values.yaml in the checkout BEFORE Renovate
extracts/edits them, committing the decrypted tree locally (never pushed,
so no plaintext secrets enter remote git). postUpgradeTasks is reduced to
'sops -e -i' only (the file is already plaintext when Renovate edits it).

Validated: kustomize build passes for the whole kubernetes/ tree.

renovate.json

@@ -10,14 +10,14 @@
     "helmv3"
   ],
   "postUpgradeTasks": {
-    "description": "SOPS round-trip on encrypted values.yaml. Renovate has no preUpgrade hook, so the decrypt must happen here: after the tag bump but before commit, decrypt the file, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values and corrupt them.",
+    "description": "Re-encrypt values.yaml after Renovate bumps an image tag. These files are decrypted to plaintext by the runner's boot.sh BEFORE Renovate extracts/edits them (Renovate has no preUpgradeTasks hook, and a post-edit decrypt would fail: editing a SOPS file invalidates its mac). So by the time this task runs, the file is plaintext and `sops -e -i` safely rebuilds a valid SOPS document carrying the bumped tag. branch mode re-encrypts each changed file once, after all deps on the branch are updated.",
     "commands": [
-      "sops -d {{packageFile}} > {{packageFile}}.plain && mv {{packageFile}}.plain {{packageFile}} && sops -e -i {{packageFile}}"
+      "sops -e -i {{packageFile}}"
     ],
     "fileFilters": [
       "**/values.yaml"
     ],
-    "executionMode": "update"
+    "executionMode": "branch"
   },
   "packageRules": [
     {