secrets: rotate + de-git Resend key; source from out-of-band Secret/resend-api

Resend send-scoped key was committed in plaintext in manifests/hub.yaml (ConfigMap)
and manifests/felhom.secret.yaml. Rotated to a new key and removed from git.

- hub: new RESEND_API_KEY env override (cmd/hub/main.go), mirrors REGISTRY_TOKEN;
  ConfigMap resend_api_key now an empty placeholder; Deployment injects from
  Secret/resend-api. Image 0.17.0.
- contact-mailer: secretKeyRef repointed contact-mailer-config -> resend-api.
- felhom.secret.yaml: contact-mailer-config Secret removed; healthchecks
  EMAIL_HOST_PASSWORD blanked (workload not deployed).
- documentation/runbooks/secrets.md: out-of-band secret model + create/rotate steps.

Secret/resend-api is created imperatively out-of-band and is NOT committed.
No secret value appears in this repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Felhom Hub — Changelog
 
+## v0.17.0 — Resend key sourced from a Secret, out of git (2026-06-29)
+
+Resend rotation + de-git hygiene. The hub's Resend API key was committed in plaintext in
+`manifests/hub.yaml`'s `hub-config` ConfigMap; it is now sourced from an out-of-band Kubernetes
+Secret (`resend-api`) and never lives in git.
+
+- **`cmd/hub/main.go`:** new `RESEND_API_KEY` env override for `notifications.resend_api_key`, mirroring
+  the existing `REGISTRY_TOKEN` / `DEFAULT_MIN_CONTROLLER_VERSION` k8s-Secret override pattern. When set,
+  it wins over the (now empty) ConfigMap field. No behaviour change when unset.
+- The committed ConfigMap `resend_api_key` is now an empty placeholder pointing at
+  `documentation/runbooks/secrets.md`; the live value is injected from `Secret/resend-api` via env.
+- Part of the Resend key rotation: the previously-exposed send-scoped key was rotated; the new key lives
+  only in the out-of-band store and `Secret/resend-api` (created imperatively, never committed). See the
+  secrets runbook. No secret value appears in this repo.
+
 ## v0.16.0 — Day-0 artifact manifest (hub-vouched agent + golden checksums) (2026-06-28)
 
 The hub now serves a passphrase-authed **artifact manifest** so the host-bootstrap script can