feat(ql3): isolate plugin secret action execution

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/cron-job.yaml

@@ -65,8 +65,6 @@ spec:
                   value: '16'
                 - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
                   value: '16'
-                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT
-                  value: /var/run/secrets/qinglong3/plugin-package-values
                 - name: QL3_POSTGRES_TLS_MODE
                   value: verify-full
                 - name: QL3_POSTGRES_TLS_CA_FILE
@@ -98,9 +96,6 @@ spec:
                 - name: postgres-package-executor-ca
                   mountPath: /var/run/secrets/qinglong3/postgres-package-executor
                   readOnly: true
-                - name: plugin-package-values
-                  mountPath: /var/run/secrets/qinglong3/plugin-package-values
-                  readOnly: true
           volumes:
             - name: tmp
               emptyDir:
@@ -113,8 +108,3 @@ spec:
                 items:
                   - key: postgres-ca.crt
                     path: ca.crt
-            - name: plugin-package-values
-              secret:
-                secretName: ql3-cluster-plugin-package-values
-                optional: true
-                defaultMode: 288

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/network-policy.yaml

@@ -10,7 +10,6 @@ metadata:
 spec:
   podSelector:
     matchLabels:
-      app.kubernetes.io/name: ql3-plugin-package-executor
       app.kubernetes.io/component: plugin-package-executor
   policyTypes:
     - Ingress

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/cron-job-patch.yaml

@@ -17,8 +17,6 @@
       value: '16'
     - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
       value: '16'
-    - name: QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT
-      value: /var/run/secrets/qinglong3/plugin-package-values
     - name: QL3_POSTGRES_TLS_MODE
       value: verify-full
     - name: QL3_POSTGRES_TLS_CA_FILE

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/config.example.yaml

@@ -11,8 +11,9 @@ stringData:
   postgres-tls-servername: REPLACE_WITH_POSTGRES_DNS_NAME
   postgres-ca.crt: REPLACE_WITH_POSTGRES_CA_CERTIFICATE
 ---
-# Optional SecretRef projection. Each key is the lowercase SHA-256 of the
-# canonical qlsecret:v1 reference; the executor checks metadata only.
+# Source for action-scoped Secret projection Jobs. The batch executor never
+# mounts this Secret. Each exact Job selects only the reviewed lowercase
+# SHA-256 key(s) for one durable dispatch and checks metadata only.
 apiVersion: v1
 kind: Secret
 metadata: