The new terragrunt-enc repo's Woodpecker CI authenticates to Vault via
kubernetes auth, which binds to a ServiceAccount in the woodpecker namespace.
- Add apps/base/woodpecker/serviceaccount_terraform_enc.yaml.
- Register it in the woodpecker kustomization.