The deploy/fleet-overlay templates had drifted from what actually runs in
anton-helm-workloads (verified live + against the emdash-kotkanagrilli
reference). Canonical design co-locates everything in the `kotkan` namespace:
- source.yaml: GitRepository flux-system -> kotkan, so the HelmRelease
chart sourceRef resolves same-namespace (no cross-namespace ref).
- secrets.yaml: deploy-key Secret -> kotkan, defined once in the staging
overlay; dropped the duplicate definition from the production overlay
(production references the shared key by name).
- image-automation.yaml: IUA write-back sourceRef
anton-workloads-image-automation/flux-system -> anton-helm-workloads/kotkan
(the existing read source already has push access).
- README.md / DEPLOYMENT.md: namespace + ownership docs corrected.