fix: correct protobuf wire type for ConfigHash and SecretKeyHashes

[steiler]

Summary

• ConfigHash (string) and SecretKeyHashes (map[string]string) in SensitiveConfigSpec were tagged with protobuf wire type varint
• varint is only valid for integer scalars; string and map fields require wire type bytes
• Any protobuf serialisation/deserialisation path (e.g. etcd storage in an aggregated API server) would produce garbled data or a runtime decode error
• Fix: change both field tags from varint to bytes

Root cause

// before
ConfigHash      string            `... protobuf:"varint,5,opt,name=configHash"`
SecretKeyHashes map[string]string `... protobuf:"varint,6,opt,name=secretKeyHashes"`

// after
ConfigHash      string            `... protobuf:"bytes,5,opt,name=configHash"`
SecretKeyHashes map[string]string `... protobuf:"bytes,6,opt,name=secretKeyHashes"`

The other fields in the struct (Lifecycle, Payload, etc.) already use bytes correctly; these two were a copy-paste mistake from integer fields above them.

Test plan

• Verify round-trip protobuf encode/decode of a SensitiveConfig with non-empty ConfigHash and SecretKeyHashes produces identical values
• Confirm no existing etcd-stored objects are corrupted (field was newly introduced on the sensitive branch, so no migration needed)

Made with Cursor

[severindellsperger]

LGTM.