fix(deploy): supply Steam credentials to the control plane, refresh stale status

The Steam adapter took --steam-publisher-key/--steam-app-id and the
matching env vars, but no manifest supplied them, so a deployed control
plane would have kept sign-in returning 503 even once the App ID from
#15 arrived -- that issue would have unblocked nothing on landing.

Mount them from a new cosmic-clash-steam Secret, into the control-plane
Deployment alone: the publisher key is issued to us, never to a client,
and no other workload (least of all a game server) has any use for it. A
manifest test asserts both the wiring and that the Secret appears in no
other manifest; verified it fails in both directions.

Both keys are optional, so the Deployment still rolls out before the App
ID exists and sign-in simply stays 503.

Also correct task rows this branch made stale: 7.4 (durable ban storage
landed), 8.7 (adapter, bans and secret store landed), 8.39 (cross-replica
fan-out landed), and 8.5's migration range, which stopped at 0013.

Move the branch review into docs/ with a header marking it a point-in-time
artefact -- all thirteen findings are addressed, and its present tense
would otherwise read as current behaviour.

Record gotcha 52: the integration scripts use `docker run --rm`, which
reclaims the container but not its anonymous volume. Sixty-four of them,
~4 GB, accumulated during this session until PostgreSQL stopped starting
-- surfacing only as the script's own readiness timeout, not as a disk
error. That is the real cause behind the "Docker storage exhausted
locally" notes those rows carried.

deploy/k8s/base/control-plane-deployment.yaml

@@ -95,3 +95,22 @@ spec:
                 secretKeyRef:
                   name: cosmic-clash-workload
                   key: secret
+            # Player sign-in. The publisher key is the credential Valve issues
+            # to us, never to a client, so it is mounted only here -- no other
+            # workload and no game server ever sees it. Both values must be
+            # present or POST /v1/session/steam keeps returning 503: silently
+            # accepting an unverified ticket would be worse than refusing to
+            # authenticate. Optional until the App ID exists (issue #15), so the
+            # Deployment still rolls out without the Secret.
+            - name: COSMIC_CLASH_STEAM_PUBLISHER_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: cosmic-clash-steam
+                  key: publisher-key
+                  optional: true
+            - name: COSMIC_CLASH_STEAM_APP_ID
+              valueFrom:
+                secretKeyRef:
+                  name: cosmic-clash-steam
+                  key: app-id
+                  optional: true