Localize external-secrets for ringtail (amd64) via nix build

container.py builds arm64 (indri/Dagger); add default.nix to build the amd64
image on ringtail's nix-container-builder (Go 1.26, -tags all_providers).
external-secrets-ringtail now uses a thin overlay over the shared manifest,
overriding only the image to the -nix tag. Repoints the app at the overlay.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

argocd/manifests/external-secrets-ringtail/kustomization.yaml

@@ -0,0 +1,16 @@
+# Ringtail (amd64) overlay for external-secrets.
+#
+# Reuses the shared indri manifest as a base and only overrides the controller
+# image to the nix-built amd64 variant (`-nix` tag). The base sets the arm64
+# image (built via containers/external-secrets/container.py on indri's Dagger
+# runner); ringtail's k3s is amd64 and needs the image built by
+# containers/external-secrets/default.nix on the nix-container-builder.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../external-secrets
+
+images:
+  - name: registry.ops.eblu.me/blumeops/external-secrets
+    newTag: PLACEHOLDER-set-after-build