#3584 kubernetes/secret: idempotent ensure method and a metadata-only get

Problem

Two gaps in @swamp/kubernetes/secret (checked against 2026.10.13.1, models/secret.ts):

1. No idempotent ensure. create calls createNamespacedSecret and fails if the Secret exists. update does read-then-replace and fails if it does not. A workflow that should converge a Secret to a desired state has to branch on existence itself, and a re-run after a partial failure breaks on create.
2. No way to read one Secret without its values. get decodes every value and writes it into the secret resource. create and update also write the decoded values back into stored data. The field is marked sensitive, so it is vaulted, but a caller that only needs to know "does it exist, which keys, what type, which resourceVersion" still copies the secret material into swamp's datastore. list returns metadata only, but for the whole namespace.

Why it matters

Converging Secrets from a vault is a common GitOps-style job, and it should be safe to re-run. Keeping secret values out of model output by default limits where they can leak: vault backends, data exports, reports, logs and other tooling that reads model data.

Proposed solution

1. An ensure (or apply) method: read the Secret; create it if absent; if present, compare the desired data/type/labels with the current ones and replace (or server-side apply) only when they differ. Return action: created | updated | unchanged. An optional prune: true would drop keys not in the desired set; without it, keys are merged as update does today. Use the read's resourceVersion on replace so concurrent writers get a 409, not a lost update.
2. A metadata-only read, either a getMeta method or get with includeValues: false. It would write a secretMeta resource (name, namespace, type, dataKeys, labels, resourceVersion) and no values. Consider having create/update/ensure write secretMeta rather than decoded data too, since the caller already holds the values it sent.

Alternatives

Callers can try create, catch the 409 and fall back to update, and use list with a label selector to check one Secret's metadata. It works, but every workflow has to reimplement it, and create/update still persist the values.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

• Extension: @swamp/kubernetes@2026.10.13.1
• swamp: 20261013.025835.0-sha.1b6f0c59
• OS: linux (aarch64)
• Deno: 2.9.7
• Shell: /usr/bin/zsh