fix(secrets): sync external secrets for existing native images

[vigneshrajsb]

Summary

• Add a shared service-level external secret sync step for native image workflows.
• Reuse that sync step when an existing image tag lets the workflow skip the image build.
• Add regression coverage for the existing-image path so secret-backed service env still reconciles before deploy.

Why

Secret reconciliation was coupled to the native image build execution path. When the image already existed, the workflow could skip the build and continue to deploy a workload that referenced a Kubernetes Secret before the matching ExternalSecret had been recreated in the namespace.