fix: align infisical key names to match user-added secrets

agents/k8s/gumbo-externalsecrets.yaml

@@ -2,8 +2,8 @@
 # These replace the stub Secret blocks that were in gumbo-job-template.yaml.
 # Requires: ExternalSecrets operator + infisical ClusterSecretStore in platform-security.
 # Infisical paths: create these secrets under your Infisical project before first sync.
-#   GUMBO_LITELLM_API_KEY   → your LiteLLM virtual key for gumbo
+#   LITELLM_API_KEY   → your LiteLLM virtual key for gumbo (in /agentic-os/)
-#   GUMBO_DB_URI            → postgresql://agentic_os:<pass>@agentic-os-pg-rw.platform-data.svc.cluster.local:5432/gumbo?sslmode=require
+#   GUMBO_DB_URI      → postgresql://agentic_os:<pass>@agentic-os-pg-rw.platform-data.svc.cluster.local:5432/gumbo?sslmode=require
 ---
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
@@ -23,7 +23,7 @@ spec:
   data:
     - secretKey: api_key
       remoteRef:
-        key: GUMBO_LITELLM_API_KEY
+        key: LITELLM_API_KEY
 ---
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret

platform/data/cnpg/externalsecret-backup-creds.yaml

@@ -1,7 +1,7 @@
 # ExternalSecret: CNPG barman backup credentials for MinIO.
-# Infisical paths to pre-populate:
+# Infisical paths to pre-populate (in /agentic-os/):
-#   CNPG_BACKUP_ACCESS_KEY_ID     → MinIO access key
+#   MINIO_ACCESS_KEY_ID     → MinIO access key
-#   CNPG_BACKUP_ACCESS_KEY_SECRET → MinIO secret key
+#   MINIO_ACCESS_KEY_SECRET → MinIO secret key
 ---
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
@@ -21,7 +21,7 @@ spec:
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
-        key: CNPG_BACKUP_ACCESS_KEY_ID
+        key: MINIO_ACCESS_KEY_ID
     - secretKey: ACCESS_KEY_SECRET
       remoteRef:
-        key: CNPG_BACKUP_ACCESS_KEY_SECRET
+        key: MINIO_ACCESS_KEY_SECRET