[P5] Replicate a peer's config Secret into the workload's namespace

[jacaudi]

Context

Secrets cannot be mounted across namespaces. When the gateway and the workload are in different namespaces — the normal case for shared infrastructure — the peer's config Secret has to exist in the workload's namespace for the injected sidecar to mount it.

This is deliberately narrow: replicating secret material into other namespaces widens its blast radius, so only the specific peer's config should travel, and only to the namespace of the pod that owns it.

Scope

Replicate a peer's config Secret into its pod's namespace, keeping it in sync and removing it when the peer goes away.

Acceptance criteria

• Only the owning pod's namespace receives the Secret
• Replica updated when the source changes, deleted when the peer is reaped
• Replica contains only that peer's material — depends on [P5] Split the aggregated peer-config Secret into per-peer Secrets #28
• Orphaned replicas cleaned up after an operator restart

Depends on #28 and #29. See docs/ROADMAP.md § Phase 5.7.