Better Secret Handling

[daniel-klein]

Users developing new modeling packages may wish to run calabaria against private repositories. Calabaria (modelops-bundle) does support PAT via environment variables that can be loaded automatically via direnv, however the process remains challenging and minimally requires a workspace restart for the variables to be picked up. Consider alternative ways to create/load secrets.

[daniel-klein]

Possible bug, on a workspace restart after defining env vars, the secrets were loaded... but into the default namespace instead of -n modelops-dask-dev

[vsbuffalo]

I think this relates to the PAT handling mops config feature I mentioned today in person. I will leave this issue open as reminder to add that feature.

According to Claude Code: Investigated and confirmed no bug exists. All secrets are correctly deployed to the modelops-dask-dev namespace (verified with kubectl get secrets -n modelops-dask-dev). The workspace.py code correctly
specifies namespace=namespace for all Secret resources. This issue appears to have been resolved in a previous commit or was misreported.