os_api: resolve pod name by label instead of hardcoded opensearch-0. added find_pod_by_label helper to kube.rs. secrets.py: sol-agent policy (read/write sol-tokens/*) and k8s auth role bound to matrix namespace default SA.