muster release v5.31.1

muster rolls when its OAuth credentials or its Valkey password change. The pod template carries checksum/oauth-secret beside checksum/config: the SHA-256 of the chart-rendered <fullname>-oauth Secret’s data, or the new muster.oauth.server.existingSecretChecksum value verbatim when the credentials come from a Secret the chart cannot read, so whoever rotates that Secret changes the mark in the same change (a Flux HelmRelease can feed it through valuesFrom with targetPath); a Valkey password in a Secret of its own is marked by muster.oauth.server.storage.valkey.existingSecretChecksum as checksum/valkey-secret. Before, muster read the projected Secrets at start and never again, so a rotated Dex client secret, encryption key or Valkey password left the running pod on the old values until a hand-run restart, and muster disagreed with Dex (invalid_client) or its Valkey (WRONGPASS) as soon as one of them restarted. The Secret template and the annotation render the data from one helper, so the two cannot drift. Chart unit tests pin the annotations. (#1315)