chore: sync hwlab node control-plane state

Capture D601 v03 control-plane YAML/CLI changes, update CI/CD skill notes, and document the hwlab.pikapython.com admin password reset boundary with follow-up issue #319.

scripts/src/platform-db.ts

@@ -878,7 +878,7 @@ function connectionStringExport(item: Record<string, unknown>, path: string): Co
     consumers: arrayOfRecords(item.consumers, `${path}.consumers`).map((consumer, index) => ({
       scope: stringField(consumer, "scope", `${path}.consumers[${index}]`),
       secret: stringField(consumer, "secret", `${path}.consumers[${index}]`),
-      key: kubernetesSecretKey(stringField(consumer, "key", `${path}.consumers[${index}]`), `${path}.consumers[${index}].key`),
+      key: envKey(stringField(consumer, "key", `${path}.consumers[${index}]`), `${path}.consumers[${index}].key`),
     })),
   };
 }
@@ -909,11 +909,6 @@ function envKey(value: string, path: string): string {
   return value;
 }
 
-function kubernetesSecretKey(value: string, path: string): string {
-  if (!/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error(`${path} must be a Kubernetes Secret key`);
-  return value;
-}
-
 function configSummary(pg: PostgresHostConfig): Record<string, unknown> {
   return {
     path: pg.configPath,