7-task plan: NetworkPolicy (default-deny + per-service), SecurityContext (pod + container hardening), secret scoping (split foxhunt-secrets), deploy-secrets.sh (Scaleway integration), Trivy CI scanning. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>