fix: add kubectl preflight check and clarify repo-root usage in comment

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/create-secrets.sh

@@ -3,6 +3,12 @@ set -euo pipefail
 
 NAMESPACE="shorefront"
 
+# --- Preflight checks ---
+if ! command -v kubectl &>/dev/null; then
+  echo "Error: kubectl is not installed or not in PATH" >&2
+  exit 1
+fi
+
 # --- Validate required env vars ---
 : "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}"
 : "${JWT_SECRET_KEY:?JWT_SECRET_KEY is required}"