Fix GitLab OIDC secret FailedMount blocking webservice/sidekiq startup

Real bug affecting both home and VPS GitLab, found live diagnosing why
VPS's webservice pod was stuck at Init:0/3 for 74+ minutes (surfacing as
404s - nothing was ever actually serving):

global.appConfig.omniauth.providers: [{secret: gitlab-oidc-secret, key:
provider}] requires that secret to have a 'provider' key (a full YAML
omniauth provider config) - gitlab-oidc-secret never has one, only
GITLAB_OIDC_CLIENT_ID/SECRET, which get consumed via extraEnvFrom +
GITLAB_OMNIBUS_CONFIG's gitlab_rails['omniauth_providers'] instead (the
actual, complete mechanism already configuring OIDC - this providers:
list was always redundant). Removed it from both values.yaml files.

Home's GitLab has run fine so far because Kubernetes doesn't re-validate
already-mounted volumes when a referenced Secret's shape changes -
webservice/sidekiq there just haven't restarted since gitlab-oidc-secret
was last (if ever) in a shape with that key. VPS's identical values
shape hit it immediately on first pod creation. This was a live landmine
for home too - fixed before it could bite on a future restart.

Also: global.kas.enabled: false added to the VPS values (gitlab.kas.enabled
alone doesn't stop KAS pods - found live, separate toggle).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/vps-standby/gitlab/values.yaml

@@ -37,6 +37,12 @@ global:
       secret: pg-gitlab-app
       key: password
 
+  # gitlab.kas.enabled: false alone doesn't stop KAS pods deploying -
+  # there's a SEPARATE global.kas.enabled toggle (default true) that
+  # actually controls it, found live 2026-08-21.
+  kas:
+    enabled: false
+
   # Single Gitaly node, no Praefect - HA routing is pointless with 1 node
   gitaly:
     enabled: true
@@ -58,6 +64,15 @@ global:
       key: password
 
   appConfig:
+    # NOTE: no `providers:` list here - found live 2026-08-21: the chart
+    # requires gitlab-oidc-secret to have a `provider` key (full YAML
+    # provider config) when this is set, and it never does - only
+    # GITLAB_OIDC_CLIENT_ID/SECRET, consumed via extraEnvFrom +
+    # GITLAB_OMNIBUS_CONFIG below instead (the actual mechanism
+    # configuring OIDC). Caused "FailedMount: references non-existent
+    # secret key: provider" blocking webservice/sidekiq/toolbox from ever
+    # starting - see the matching fix + full explanation in
+    # apps/gitlab/values.yaml (home).
     omniauth:
       enabled: true
       allowSingleSignOn: ['openid_connect']
@@ -65,9 +80,6 @@ global:
       autoLinkUser: ['openid_connect']
       syncProfileFromProvider: ['openid_connect']
       syncProfileAttributes: ['email', 'name']
-      providers:
-        - secret: gitlab-oidc-secret
-          key: provider
 
 # GitLab's pre-upgrade hook checks the deployed version against a
 # previous-release ConfigMap to enforce supported upgrade paths - found