The dockerconfigjson held the old account password (now rotated/revoked) in plaintext. Manage this image-pull secret out-of-band via kubectl (like researchowl), so no registry credential lives in git going forward. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>