Clone dev into envs/staging and envs/prod, deploying to namespaces
dbiz-staging and dbiz-prod on the same cluster. App names suffixed per
env, destination namespaces + external-services namespaces + ingress
hosts adjusted. Monitoring kept as a single cluster-wide stack in dev
(not duplicated). Sealed secrets left empty pending per-namespace
re-seal (sealed secrets are namespace-scoped).
