Default the optional env-secret slots

optional: true covers a Secret that does not exist; it does not cover the
variable being unset. Flux substitutes in strict mode, so the unused second
slot failed the whole build and every change to this repo since has silently
stopped reaching the cluster.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/n8n/deployment.yaml

@@ -81,13 +81,19 @@ spec:
             #
             # Two slots rather than one, because a deployment's environment
             # usually comes from more than one owner — credentials the platform
-            # holds, and credentials a workflow's own estate holds. Both are
-            # marked optional, so an unused slot needs no placeholder Secret.
+            # holds, and credentials a workflow's own estate holds.
+            #
+            # `optional: true` covers a Secret that does not exist; the `:=`
+            # defaults cover the *variable* not being set. Both are needed, and
+            # only the first was here: Flux substitutes in strict mode, so an
+            # unused slot failed the whole build rather than being skipped, and
+            # every later change to this repo silently stopped reaching the
+            # cluster.
             - secretRef:
-                name: ${EXTRA_ENV_SECRET}
+                name: ${EXTRA_ENV_SECRET:=n8n-extra-env}
                 optional: true
             - secretRef:
-                name: ${EXTRA_ENV_SECRET_2}
+                name: ${EXTRA_ENV_SECRET_2:=n8n-extra-env-2}
                 optional: true
           volumeMounts:
             - name: data