fix: add kubectl preflight check and clarify repo-root usage in comment

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

helm/shorefront/values-prod.yaml

@@ -1,8 +1,8 @@
 ingress:
   host: shorefront.yourdomain.com
 
-# Secrets are NOT managed by Helm. Run scripts/create-secrets.sh before
-# the first helm install/ArgoCD sync:
+# Secrets are NOT managed by Helm. Run scripts/create-secrets.sh from the
+# repository root before the first helm install/ArgoCD sync:
 #
 #   export POSTGRES_PASSWORD=<real-password>
 #   export JWT_SECRET_KEY=<real-jwt-secret>

scripts/create-secrets.sh

@@ -3,6 +3,12 @@ set -euo pipefail
 
 NAMESPACE="shorefront"
 
+# --- Preflight checks ---
+if ! command -v kubectl &>/dev/null; then
+  echo "Error: kubectl is not installed or not in PATH" >&2
+  exit 1
+fi
+
 # --- Validate required env vars ---
 : "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}"
 : "${JWT_SECRET_KEY:?JWT_SECRET_KEY is required}"