[WuShang-d]

Summary

Seventeen sealos catalog templates, including Chrome, Excalidraw, Affine and Immich, name an imagePullSecret that Sealos would create and CasOS never does. Kubelet then warns FailedToRetrieveImagePullSecret and may skip the pull.

When a market template is applied, CasOS now drops pull secrets that are not in the namespace, the same way it already drops an Ingress class this cluster does not run. A secret that does exist, or that the template itself creates earlier in the same apply, is kept. If the namespace cannot be listed, the template is left unchanged.

Verification

• go build ./..., go vet ./..., go test ./controllers/ -run TestStripMissingImagePullSecrets, go test ./i18n/ -run TestDeduplicate
• On a CasOS install with a real Linux worker, installed the sealos catalog template excalidraw (it ships imagePullSecrets: [{name: ${{ defaults.app_name }}}] and no matching Secret). The Deployment and Pod had no imagePullSecrets; the app became Ready; http://excalidraw-*.localhost:20080 returned 200 with title Excalidraw | Hand-drawn look & feel • Collaborative • Secure; uninstall removed the pods.

Fix: #165