Implement the promotable GitOps Kubernetes output profile

[AntoineToussaint]

Problem

The current v0.0.108 release pins Core v0.2.49 and contains no handling for the Kubernetes output profiles introduced by codefly-dev/core#101. Its templates always include namespace.yaml and a Secret populated from SecretMap; the migration Job and Kustomize image transform use image:tag.

As a result, Codefly cannot produce a secret-free, service-scoped, digest-pinned tree for the Mind users module. The module generator correctly rejects the current output, blocking codefly-dev/mind#216.

Acceptance criteria

• Pin the released Core contract tracked by Release the promotable Kubernetes manifest contract core#103.
• Implement and return the exact requested Kubernetes output profile.
• Keep populated Kubernetes Secrets available only to the explicitly ephemeral local-apply profile.
• For the promotable GitOps profile, consume only typed secret references and emit no Secret data or stringData.
• Omit Namespace, RBAC, and other cluster-scoped resources from the promotable service-owned tree.
• Emit digest-pinned images and satisfy the shared restricted-workload validator.
• Run the shared official-plugin positive and hostile conformance suite against real Kustomize rendering.
• Publish a downloadable release and prove it is resolvable by Codefly CI.

Blocks codefly-dev/mind#216 and the complete integration of codefly-dev/cli#152.