Old out-of-band umami-secrets deleted (kubectl); the /data ignoreDifferences stanza referencing it is now dead. Removed from both the registered app manifest and the in-dir duplicate. umami-secrets-infisical is Owner-managed by the operator, not a git-tracked Secret, so no ignore rule is needed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>