Adds a `secrets:` key to spec.yml that references pre-existing k8s
Secrets by name. SO mounts them as envFrom.secretRef on all pod
containers. Secret contents are managed out-of-band by the operator.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>