Mount the umami provisioning job's two secrets as files instead of environment variables #3117

🤖 Generated by the Agentic Engineer

Evidence

scripts/megalinter-scan-counts.sh --checkov-only at 2adb99c8 reports 3 failing checks. Two
are CKV_K8S_40 (tracked by #2904). The third is the only one with no issue behind it:

CKV_K8S_35  k8s/bases/apps/umami/cron-job.yaml  CronJob.umami.umami-provision-tenants
            "Prefer using secrets as files over secrets as environment variables"

The object injects two secrets as environment variables:

Why it matters

An environment variable is readable by anything that can read the process environment and is
routinely copied into crash dumps, child processes and log/diagnostic output; a mounted file is
not. This is the last checkov finding on this object — #3116 fixed its CKV_K8S_22 — and with
#2904 it is one of the two things standing between the checkov backlog and zero, which is what
#2787 needs before REPOSITORY_CHECKOV can come out of DISABLE_ERRORS_LINTERS.

Why it is not a one-line change

The consumer is an inline node -e script that reads process.env.ADMIN_PASSWORD and resolves
member passwords by name through passwordEnv in the TENANTS JSON. Moving to files means:

1. mounting both secrets (projected or two secret volumes) and reading them with fs;
2. re-expressing passwordEnv — the indirection is the point of that field, so it becomes
   something like passwordFile, and the TENANTS JSON contract changes with it;
3. preserving the optional: true semantics. This is the subtle part: an optional env var
   simply does not appear, whereas an optional secret volume mounts as an empty directory — so
   "the bootstrap Secret was removed once the customer owned their password" has to be detected as
   a missing/empty file rather than an undefined variable, or the job starts resetting a password
   it must never touch.

(3) is a real correctness hazard, not ceremony: the file header states this job never resets an
existing user's password, and a naive port would silently break that guarantee.

Acceptance criteria

• Both secrets are mounted as files; neither appears in env
• scripts/megalinter-scan-counts.sh --checkov-only no longer reports CKV_K8S_35
• A missing/empty optional bootstrap secret still results in no password write, proven by a case that fails if that check is removed
• The TENANTS contract change is documented in the file header alongside the existing passwordEnv explanation

Rough size: small-to-medium — the manifest edit is easy, the optional-secret semantics carry the risk.

Part of #2787