fix(deploy): set ProviderConfig secretRef.namespace (required field) (#42)

The namespaced github.m.upbound.io ProviderConfig still requires
spec.credentials.secretRef.namespace (the CRD enforces it); omitting it made
the platform tenant's Flux apply fail dry-run, blocking the whole artifact
(ExternalSecret + ProviderConfig + Repository MRs). secretRef.namespace is a
value, not the resource namespace, so targetNamespace can't inject it — set it
explicitly to github-config where the credential Secret is materialized.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: devantler

deploy/provider-config.yaml

@@ -2,10 +2,13 @@
 # against the devantler-tech org as a GitHub App. Tenant-owned (applied by the
 # github-config app's ServiceAccount). It is referenced by the namespaced
 # Repository/… managed resources in this same namespace. The credentials Secret
-# is local (same namespace), materialized by external-secret.yaml from OpenBao.
-# namespace is omitted on purpose — the platform tenant Kustomization injects it
-# via targetNamespace (= github-config). The github.m.upbound.io CRD is installed
-# by the provider package (platform infrastructure layer).
+# is materialized by external-secret.yaml from OpenBao.
+#
+# The resource's own namespace is omitted on purpose — the platform tenant
+# Kustomization injects it via targetNamespace (= github-config). But
+# spec.credentials.secretRef.namespace is a REQUIRED field (the CRD enforces it
+# even for a namespaced ProviderConfig) and is a value, not the resource
+# namespace, so it must be set explicitly to where the credential Secret lives.
 apiVersion: github.m.upbound.io/v1beta1
 kind: ProviderConfig
 metadata:
@@ -14,5 +17,6 @@ spec:
   credentials:
     source: Secret
     secretRef:
+      namespace: github-config
       name: github-app-credentials
       key: credentials