The Navigator deployment matrix

Each deployment has one config.toml and one encrypted secrets.enc.yaml under the operator-managed deployment root: $NAVIGATOR_DEPLOYMENTS_DIR/deployments/<row>/. The config supplies that row's project, region, cluster, namespace, host, and image settings. Keep each row's database, buckets, Kubernetes namespace, runtime identity, and Secret isolated from other rows. The private root is supplied by the operator and is not part of this source repository.