sindri-registration becomes an ExternalSecret (role meru-<app>-build-eso, apps/meru/<app>-build/eso/sindri-registration, Owner - D68). Store at wave -2 so it is validated before the ExternalSecret asks; Namespace at -3 so a first install creates it before the objects inside it. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR