[] Add helm/templates/secret.yaml (lookup-idempotent), serviceaccount.yaml, rbac.yaml; update deployment.yaml and worker-deployment.yaml with SecurityContext and secret injection#290