exchange-api: declare the ghcr pull secret for lux-ns

lux-ns holds no KMS identity, so exchange-api ImagePullBackOff'd on
ghcr.io/luxfi/exchange-api with no dockerconfigjson in the namespace.
Project the shared hanzo ghcr-secret (reads luxfi images) as a
dockerconfigjson pull secret, matching how every other namespace
declares one.


Co-authored-by: Hanzo Dev <[email protected]>

deploy/lux-ns/exchange-api.yaml

@@ -107,3 +107,14 @@ tolerations:
 - key: hanzo.ai/no-ci
   operator: Exists
   effect: NoSchedule
+
+# Pull credential for ghcr.io/luxfi/exchange-api. lux-ns holds no KMS identity of
+# its own; this projects the shared hanzo ghcr-secret (which reads luxfi images)
+# as a dockerconfigjson the kubelet honours. Interim: a hand-applied Secret of the
+# same name carries until the kms projector reconciles this.
+kmsSecrets:
+- name: ghcr-secret-kms-sync
+  secretsPath: /ghcr-secret
+  keys: [.dockerconfigjson]
+  secretName: ghcr-secret
+  secretType: kubernetes.io/dockerconfigjson