fix(deploy): supply Steam credentials to the control plane, refresh stale status

The Steam adapter took --steam-publisher-key/--steam-app-id and the
matching env vars, but no manifest supplied them, so a deployed control
plane would have kept sign-in returning 503 even once the App ID from
#15 arrived -- that issue would have unblocked nothing on landing.

Mount them from a new cosmic-clash-steam Secret, into the control-plane
Deployment alone: the publisher key is issued to us, never to a client,
and no other workload (least of all a game server) has any use for it. A
manifest test asserts both the wiring and that the Secret appears in no
other manifest; verified it fails in both directions.

Both keys are optional, so the Deployment still rolls out before the App
ID exists and sign-in simply stays 503.

Also correct task rows this branch made stale: 7.4 (durable ban storage
landed), 8.7 (adapter, bans and secret store landed), 8.39 (cross-replica
fan-out landed), and 8.5's migration range, which stopped at 0013.

Move the branch review into docs/ with a header marking it a point-in-time
artefact -- all thirteen findings are addressed, and its present tense
would otherwise read as current behaviour.

Record gotcha 52: the integration scripts use `docker run --rm`, which
reclaims the container but not its anonymous volume. Sixty-four of them,
~4 GB, accumulated during this session until PostgreSQL stopped starting
-- surfacing only as the script's own readiness timeout, not as a disk
error. That is the real cause behind the "Docker storage exhausted
locally" notes those rows carried.

server/security/test_kubernetes_policies.py

@@ -228,6 +228,30 @@ class KubernetesPolicyTest(unittest.TestCase):
         # The matcher never calls the control plane's API.
         self.assertNotIn("port: 8080", matcher)
 
+    def test_steam_publisher_credentials_reach_only_the_control_plane(self):
+        # The adapter and flags existed but no manifest supplied them, so a
+        # deployed control plane would have kept sign-in disabled even once the
+        # App ID landed -- making issue #15 unblock nothing on arrival.
+        deployment = self.read("control-plane-deployment.yaml")
+        for required in (
+            "name: COSMIC_CLASH_STEAM_PUBLISHER_KEY",
+            "name: COSMIC_CLASH_STEAM_APP_ID",
+            "name: cosmic-clash-steam",
+            "key: publisher-key",
+            "key: app-id",
+        ):
+            self.assertIn(required, deployment)
+        # Optional until the App ID exists, so the Deployment still rolls out
+        # without the Secret and sign-in simply stays 503.
+        self.assertIn("optional: true", deployment)
+
+        # The publisher key is issued to us, never to a client. No other
+        # workload -- and above all no game server -- may mount it.
+        for name in sorted(BASE.glob("*.yaml")):
+            if name.name == "control-plane-deployment.yaml":
+                continue
+            self.assertNotIn("cosmic-clash-steam", name.read_text(), name.name)
+
 
 if __name__ == "__main__":
     unittest.main()