docs(ops): update operational docs for Kustomize + GitOps deploy path

The Helm chart and the Helm-based GHA workflows were deleted in #62, but
my doc edits in the same change-set never made it into that commit (only
the `git rm` deletions were staged when I committed). Catching the rest up:

- docs/operations/deploy.md — rewrite around the Kustomize manifests +
  GitOps via cfp-sandbox-cluster. Preserves the still-useful sections:
  image build (with `--platform=linux/amd64` note for Apple Silicon),
  boot sequence (with entrypoint reconciliation), probes, env-var
  reference, bucket-provisioning reqs, rollback semantics.
- docs/operations/runbook.md — replace `helm history/rollback/upgrade`
  recovery with GitOps deploy-PR revert + `kubectl set image` hotfix;
  reword the CFP_DATA_REMOTE boot-failure row to point at the
  SealedSecret.
- docs/operations/secrets.md — describe the SealedSecret flow that
  actually populates the cluster's env Secret + deploy-key Secret.
- docs/operations/monitoring.md, cutover.md — small touch-ups removing
  Helm references.

plans/deploy.md left untouched per the plans protocol (frozen at
status: done).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: themightychris

docs/operations/cutover.md

@@ -122,10 +122,11 @@ fresh private-storage bucket.
    Every counter should be zero in the orphan + inconsistent categories.
    If anything is flagged, **stop** and investigate before T-0.
 
-9. Deploy the rewrite to production with `helm upgrade --install` per
-   [deploy.md](deploy.md). The pod will boot against the just-imported
-   data + bucket but receive no public traffic yet (ingress hostname not
-   pointed yet).
+9. Deploy the rewrite to production via the production GitOps repo (a
+   sibling to [`cfp-sandbox-cluster`](https://github.com/CodeForPhilly/cfp-sandbox-cluster)
+   — see [deploy.md](deploy.md)). The pod will boot against the
+   just-imported data + bucket but receive no public traffic yet (Gateway
+   hostname not pointed at the prod LoadBalancer yet).
 
 10. Smoke-test the production hostname through `/etc/hosts` or via direct
     cluster IP: hit `/api/health`, `/api/people/<known-slug>`,