- Remove sealed-argocd-token.yaml from base - Add overlays/dev/sealed-argocd-token.yaml (namespace: portfolio-dev) - Add overlays/prod/sealed-argocd-token.yaml (namespace: portfolio) - Add SealedSecret references to each overlay kustomization.yaml - SealedSecret includes namespace during encryption, needs per-env management