Add stable secret to woodpecker agent

woodpecker/agent-secret.yaml

@@ -0,0 +1,16 @@
+---
+# Stable shared agent secret. The Helm chart's built-in
+# woodpecker-default-agent-secret is generated with randAlphaNum at
+# template time, so every ArgoCD render/sync produced a new value and
+# agents started after a sync could no longer authenticate against the
+# running server ("individual agent not found by token").
+apiVersion: codemowers.cloud/v1beta1
+kind: SecretClaim
+metadata:
+  name: woodpecker-agent-secret
+  namespace: woodpecker
+spec:
+  size: 32
+  mapping:
+    - key: WOODPECKER_AGENT_SECRET
+      value: "%(plaintext)s"