[FIX] Move substitute files into a tmpl folder

Cleans up `envsubst` command and allows command to be re-run

tmpl/cluster-secrets.yaml

@@ -0,0 +1,10 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cluster-secrets
+    namespace: flux-system
+stringData:
+    SECRET_DOMAIN: $BOOTSTRAP_DOMAIN
+    SECRET_DOMAIN_CERT: $BOOTSTRAP_DOMAIN_CERT
+    SECRET_CLOUDFLARE_EMAIL: $BOOTSTRAP_CLOUDFLARE_EMAIL