chore(deploy): hold sagent off until its admin key exists

sagent.enabled was true with only baseUrl set, and the new config
validation refuses to start a host without an admin key:

  Error: loading configuration
  Caused by: config validation failed: sagent.admin_key must not be empty
             when sagent is enabled

That is what killed the rollout of sha-510cdb9 - the new apihost pod
crash-looped, the Deployment missed its progress deadline and the release
auto-rolled back - so the flag goes to false to let the code land.

agent.gitdata.ai is outside this cluster, so the key can only come from
that platform. To turn it back on: put APP_SAGENT__ADMIN_KEY in
PROD_SECRET_VALUES (secret.env reaches every host through envFrom, no
chart change needed - the same path APP_PUSH__VAPID_PRIVATE_KEY uses) and
set enabled back to true here.