feat(backup-system): migración completa a GitOps

- CronJob rclone-mega-backup entra en git (solo existía imperativo)
- Scripts backup.sh/verify.sh/rclone-mega.sh como ConfigMap backup-scripts
  (antes hostPath /data/backups/scripts — cambios ahora pasan por git+ArgoCD)
- rclone.conf vía InfisicalStaticSecret (homelab/prod//backup-system → RCLONE_CONF),
  sustituye al hostPath de ~/.config/rclone/rclone.conf
- Imágenes pinneadas: rclone 1.74.3, bitnami/kubectl por digest (v1.36.2)
- ClusterRole/CRB de backup-sa entran en git
- Application ArgoCD backup-system (auto-sync + prune + selfHeal)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backup-system/cronjob-backup.yaml

@@ -20,7 +20,9 @@ spec:
             kubernetes.io/hostname: chemavx-k8
           containers:
           - name: backup
-            image: bitnami/kubectl:latest
+            # bitnami/kubectl v1.36.2 — pinneado por digest: los tags de bitnami
+            # en Docker Hub ya no son fiables (migración Broadcom/bitnamilegacy)
+            image: docker.io/bitnami/kubectl@sha256:558420daf32bbc382e3e9af4537f4073085b336ddd47399a3b70e70087115978
             command: ["/bin/bash", "/scripts/backup.sh"]
             env:
             - name: KUBECONFIG
@@ -62,9 +64,9 @@ spec:
               path: /data/openclaw
               type: DirectoryOrCreate
           - name: scripts
-            hostPath:
-              path: /data/backups/scripts
-              type: Directory
+            configMap:
+              name: backup-scripts
+              defaultMode: 0755
           - name: k3s-storage
             hostPath:
               path: /var/lib/rancher/k3s/storage