Shared Storage V2: Write rendered data to Kubernetes Secrets

Description

Add an ESS Agent template sink that writes rendered sensitive data to a configured key in an existing Kubernetes Secret instead of a filesystem destination.

Requirements

• Parse k8s_secret { name namespace key }.
• Reject templates that set both destination and k8s_secret.
• Use the in-cluster Kubernetes client to patch only the owned data[key].
• Enforce the 768 KiB decoded per-key and 900 KiB decoded total-data limits.
• Preserve unchanged-value no-op behavior and return clear errors for NotFound, Forbidden, and retryable API failures.

Definition of Done

• Tests cover configuration validation, patch behavior, unchanged values, size limits, and API errors.
• Unrelated Secret keys remain unchanged.