fix: hunts-pause switches the engine's hunt-runner secret group off too

[catinspace-au]

hunts-pause switched the hunt runner off and left the engine reading its password.

• hunts-pause set huntRunner.enabled false and nothing else
• dfe-extras then stops minting the hunt-runner-clickhouse Secret
• the engine Deployment still reads it through a required secretKeyRef on DFE_CLICKHOUSE_HUNT_RUNNER_PASSWORD, so the engine pod sits in CreateContainerConfigError

hunts-pause now also sets secrets.hunt-runner.enabled false. hunts-resume sets both back, otherwise the runner returns reading a password the engine no longer adopts. The governance README says why a switch-off action carries its secret group.

Checked by rendering the thin path (dfe-engine at its pinned chart digest, beside dfe-extras) with each overlay:

• pause alone drops the Secret and keeps the engine env var
• pause with the secret group off drops both
• pause then resume renders the same objects as the unchanged deploy

The render test is dfe-infra's test_governance_actions.py and runs against this tree.

Done when hunts-pause renders an engine pod with nothing left to wait on.