Fail fast with a clear error when KUBECONFIG secret is missing

An unset secret expands to empty, base64 -d writes a zero-byte kubeconfig,
and kubectl falls back to localhost:8080 with a misleading connection
error. Guard both jobs and echo the current context after configuring.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -32,9 +32,14 @@ jobs:
 
       - name: Configure kubectl
         run: |
+          if [ -z "${{ secrets.KUBECONFIG }}" ]; then
+            echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
+            exit 1
+          fi
           mkdir -p $HOME/.kube
           echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
           chmod 600 $HOME/.kube/config
+          kubectl config current-context
 
       - name: Server-side dry-run of full kustomization
         run: |
@@ -65,9 +70,14 @@ jobs:
 
       - name: Configure kubectl
         run: |
+          if [ -z "${{ secrets.KUBECONFIG }}" ]; then
+            echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
+            exit 1
+          fi
           mkdir -p $HOME/.kube
           echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
           chmod 600 $HOME/.kube/config
+          kubectl config current-context
 
       - name: Apply kustomization
         run: |