Quote the substituted ConfigMap values

A ConfigMap's data values must be strings. EXECUTIONS_DATA_MAX_AGE and
N8N_BLOCK_ENV_ACCESS_IN_NODE resolved to a number and a boolean, and the apply
failed on the type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/n8n/configmap.yaml

@@ -1,3 +1,8 @@
+# Every substituted value is quoted. A ConfigMap's data values must be strings,
+# and an unquoted ${VAR} that resolves to a number or a boolean becomes one in
+# YAML — the apply then fails on the type, naming a field the operator never
+# wrote a type for.
+#
 # Nothing here is sensitive. The two values that are — the database password and
 # the credential encryption key — arrive through n8n-secrets.
 apiVersion: v1
@@ -6,15 +11,15 @@ metadata:
   name: n8n-config
   namespace: ${NAMESPACE}
 data:
-  GENERIC_TIMEZONE: ${TIMEZONE}
-  TZ: ${TIMEZONE}
+  GENERIC_TIMEZONE: "${TIMEZONE}"
+  TZ: "${TIMEZONE}"
   NODE_ENV: production
 
   # What n8n believes it is reachable at. It goes into the webhook URLs it
   # generates and into the links it puts in its own UI, so it must be the
   # ingress host and not the Service — a webhook advertised as `n8n` inside the
   # cluster is a webhook nothing outside can call.
-  N8N_HOST: ${N8N_HOSTNAME}
+  N8N_HOST: "${N8N_HOSTNAME}"
   N8N_PORT: "5678"
   N8N_PROTOCOL: https
   WEBHOOK_URL: https://${N8N_HOSTNAME}/
@@ -28,8 +33,7 @@ data:
   # The default is to keep every execution for ever, which turns the database
   # into a log. Two weeks is long enough to debug a failed run.
   EXECUTIONS_DATA_PRUNE: "true"
-  EXECUTIONS_DATA_MAX_AGE: ${EXECUTIONS_MAX_AGE_HOURS}
-
+  EXECUTIONS_DATA_MAX_AGE: "${EXECUTIONS_MAX_AGE_HOURS}"
   N8N_DIAGNOSTICS_ENABLED: "false"
   N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
   N8N_RUNNERS_ENABLED: "true"
@@ -38,4 +42,4 @@ data:
   # workflow without being stored in the workflow JSON. n8n blocks it by
   # default, and that default is right wherever more than one team can write a
   # workflow: any workflow can then read any variable in the pod.
-  N8N_BLOCK_ENV_ACCESS_IN_NODE: ${BLOCK_ENV_ACCESS}
+  N8N_BLOCK_ENV_ACCESS_IN_NODE: "${BLOCK_ENV_ACCESS}"