Populate BACKSTAGE_AUTH_TOKEN and run end-to-end trigger smoke test

[patrick-hermann-sva]

Context

End-to-end wiring for the kro-based BackstageTemplateRun trigger is now in place (see backstage-template-execution/trigger/):

• KRO RGD installed and Active on ci-mgmt-t1
• dapr-backstage-template-execution worker pod reaches Backstage over HTTPS (internal CA mounted via backstage-ca Secret)
• daprd sidecar bound to 0.0.0.0:3500 so the trigger Job can POST workflow starts
• Applying trigger/examples/create-terraform-vm.yaml successfully creates CM + Job, starts a workflow instance, and the worker picks it up

However the very first real run fails at step 1 with Backstage HTTP 401 Missing credentials because the BACKSTAGE_AUTH_TOKEN env var is empty — the upstream Secret/dapr-backstage-tpl-vars in flux-system only contains REDIS_PASSWORD.

Tasks

• Obtain a valid Backstage service-to-service token for https://backstage.platform.sthings-vsphere.labul.sva.de
• Add BACKSTAGE_AUTH_TOKEN to Secret/dapr-backstage-tpl-vars in flux-system on ci-mgmt-t1 (patch or full re-apply)
• flux reconcile kustomization dapr-backstage-template-execution --with-source to re-render Secret/backstage-auth-token in backstage-workflows
• kubectl -n backstage-workflows rollout restart deploy/backstage-template-execution (env is wired via secretKeyRef, only read at pod start)
• Re-apply trigger/examples/create-terraform-vm.yaml with dryRun: true and confirm the workflow reaches COMPLETED without the 401
• Flip to dryRun: false for a real VM run and verify the watch block picks up the resulting PR / GitHub Actions run
• Delete the BackstageTemplateRun CR after the test so kro doesn't re-create the Job on every reconcile

Follow-ups

• Move dapr-backstage-tpl-vars out of in-cluster manual state and into a SOPS-encrypted secret committed under stuttgart-things/clusters/labul/vsphere/cd-mgmt-1/ — currently it only exists because someone kubectl apply'd it once, so it won't survive a cluster rebuild
• Same treatment for GITHUB_TOKEN

Reference

Trigger CR: backstage-template-execution/trigger/examples/create-terraform-vm.yaml
RGD: backstage-template-execution/trigger/rgd.yaml
Worker app: flux/apps/dapr/components/template-execution/