feat(backup-system): migración completa a GitOps

- CronJob rclone-mega-backup entra en git (solo existía imperativo)
- Scripts backup.sh/verify.sh/rclone-mega.sh como ConfigMap backup-scripts
  (antes hostPath /data/backups/scripts — cambios ahora pasan por git+ArgoCD)
- rclone.conf vía InfisicalStaticSecret (homelab/prod//backup-system → RCLONE_CONF),
  sustituye al hostPath de ~/.config/rclone/rclone.conf
- Imágenes pinneadas: rclone 1.74.3, bitnami/kubectl por digest (v1.36.2)
- ClusterRole/CRB de backup-sa entran en git
- Application ArgoCD backup-system (auto-sync + prune + selfHeal)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/cronjob-backup-verify.yaml

@@ -19,7 +19,8 @@ spec:
             runAsUser: 0
           containers:
             - name: verify
-              image: rclone/rclone:latest
+              # OJO: imagen BusyBox — verify.sh debe evitar GNU-ismos (date -d 'yesterday')
+              image: docker.io/rclone/rclone:1.74.3
               command: ["/bin/sh", "/scripts/verify.sh"]
               resources:
                 limits:
@@ -29,16 +30,18 @@ spec:
                   cpu: 50m
                   memory: 64Mi
               volumeMounts:
-                - mountPath: /rclone/rclone.conf
+                - mountPath: /rclone
                   name: rclone-conf
                 - mountPath: /scripts
                   name: scripts
           volumes:
             - name: rclone-conf
-              hostPath:
-                path: /home/chemavx/.config/rclone/rclone.conf
-                type: File
+              secret:
+                secretName: rclone-conf-infisical
+                items:
+                  - key: RCLONE_CONF
+                    path: rclone.conf
             - name: scripts
-              hostPath:
-                path: /data/backups/scripts
-                type: Directory
+              configMap:
+                name: backup-scripts
+                defaultMode: 0755