researchowl: repoint to Infisical secret + flip to Recreate

3b of the centralization. All 5 secretKeyRefs now reference
researchowl-secrets-infisical (synced from /researchowl). Also adds
strategy: Recreate (single-replica RWO SQLite/WAL — avoids two pods
briefly sharing /data/researchowl.db during a roll), permanent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

researchowl/deployment.yaml

@@ -30,6 +30,10 @@ metadata:
     app: researchowl
 spec:
   replicas: 1
+  # Single-replica bot on a RWO local-path SQLite DB (WAL): Recreate avoids two pods
+  # briefly opening /data/researchowl.db during a roll (double-writer corruption risk).
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: researchowl
@@ -46,12 +50,12 @@ spec:
             - name: TELEGRAM_BOT_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: telegram-bot-token
             - name: TELEGRAM_ALLOWED_USERS
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: telegram-allowed-users
             - name: OLLAMA_URL
               value: "http://ollama.ollama.svc.cluster.local:11434"
@@ -70,21 +74,21 @@ spec:
             - name: ANTHROPIC_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: anthropic-api-key
             - name: GHOST_URL
               value: "https://zonadeexclusion.com"
             - name: GHOST_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: ghost-api-key
             - name: GHOST_URL_EN
               value: "https://www.theexclusionzone.com"
             - name: GHOST_API_KEY_EN
               valueFrom:
                 secretKeyRef:
-                  name: researchowl-secrets
+                  name: researchowl-secrets-infisical
                   key: ghost-api-key-en
           volumeMounts:
             - name: data