[ci skip] phase 5+6: update CI pipelines for SOPS, add sensitive=true to secret vars

Phase 5 — CI pipelines:
- default.yml: add SOPS decrypt in prepare step, change git add . to
  specific paths (stacks/ state/ .woodpecker/), cleanup on success+failure
- renew-tls.yml: change git add . to git add secrets/ state/

Phase 6 — sensitive=true:
- Add sensitive = true to 256 variable declarations across 149 stack files
- Prevents secret values from appearing in terraform plan output
- Does NOT modify shared modules (ingress_factory, nfs_volume) to avoid
  breaking module interface contracts

Note: CI pipeline SOPS decryption requires sops_age_key Woodpecker secret
to be created before the pipeline will work with SOPS. Until then, the old
terraform.tfvars path continues to function.

stacks/webhook_handler/main.tf

@@ -1,11 +1,32 @@
-variable "tls_secret_name" { type = string }
-variable "webhook_handler_secret" { type = string }
-variable "webhook_handler_fb_verify_token" { type = string }
-variable "webhook_handler_fb_page_token" { type = string }
-variable "webhook_handler_fb_app_secret" { type = string }
+variable "tls_secret_name" {
+  type = string
+  sensitive = true
+}
+variable "webhook_handler_secret" {
+  type = string
+  sensitive = true
+}
+variable "webhook_handler_fb_verify_token" {
+  type = string
+  sensitive = true
+}
+variable "webhook_handler_fb_page_token" {
+  type = string
+  sensitive = true
+}
+variable "webhook_handler_fb_app_secret" {
+  type = string
+  sensitive = true
+}
 variable "webhook_handler_git_user" { type = string }
-variable "webhook_handler_git_token" { type = string }
-variable "webhook_handler_ssh_key" { type = string }
+variable "webhook_handler_git_token" {
+  type = string
+  sensitive = true
+}
+variable "webhook_handler_ssh_key" {
+  type = string
+  sensitive = true
+}
 
 
 resource "kubernetes_namespace" "webhook-handler" {

stacks/webhook_handler/providers.tf

@@ -2,6 +2,7 @@
 variable "kube_config_path" {
   type    = string
   default = "~/.kube/config"
+  sensitive = true
 }
 
 provider "kubernetes" {