stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.woodpecker/build-cli.yml

@@ -1,42 +0,0 @@
-when:
-  event: push
-
-clone:
-  git:
-    image: woodpeckerci/plugin-git
-    settings:
-      attempts: 5
-      backoff: 10s
-
-steps:
-  - name: build-image
-    image: woodpeckerci/plugin-docker-buildx
-    settings:
-      username: "viktorbarzin"
-      password:
-        from_secret: dockerhub-pat
-      # Phase 4 of forgejo-registry-consolidation 2026-05-07 —
-      # registry.viktorbarzin.me:5050 decommissioned. Push to DockerHub
-      # (the public-facing infra image) AND Forgejo (the cluster pull
-      # source). Same image, two locations.
-      repo:
-        - viktorbarzin/infra
-        - forgejo.viktorbarzin.me/viktor/infra
-      logins:
-        - registry: https://index.docker.io/v1/
-          username: viktorbarzin
-          password:
-            from_secret: dockerhub-pat
-        - registry: forgejo.viktorbarzin.me
-          username:
-            from_secret: forgejo_user
-          password:
-            from_secret: forgejo_push_token
-      dockerfile: cli/Dockerfile
-      context: cli
-      auto_tag: true
-      # cache_from/cache_to removed: registry cache corruption causes
-      # "short read: expected 32 bytes" BuildKit errors. Inline cache
-      # will be re-populated once a clean image is pushed.
-      # cache_from: "registry.viktorbarzin.me:5050/infra:latest"
-      # cache_to: "type=inline"