fix(canopy): set PGRO_REGION on the proxy sidecar from creds Secret

The canopy-proxy binary reads PGRO_REGION as a required env var to sign
outgoing S3 requests for the right region. Both the restore Job builder
and the snapshot-list Job builder were plumbing PGRO_BROKER_URL /
PGRO_GROUP / PGRO_TYPE / PGRO_STATS_CALLBACK_URL but had lost
PGRO_REGION in the refactor. Sidecar exited at startup with
'canopy-proxy: PGRO_REGION not set' and the kopia container's
port-file wait timed out.

Region already lives on the namespace-local canopy-creds Secret the
syncer materialises (`data.region`), so wire it via env_from_secret_name
rather than adding a new field to KopiaSource / CanopySource.

Author: passcod

src/controllers/replica/resources.rs

@@ -213,6 +213,14 @@ fi
 					value: Some(backup_type.clone()),
 					..Default::default()
 				},
+				// Region comes from the canopy-creds Secret the syncer
+				// materialises alongside this Job; the sidecar signs S3
+				// requests for it before forwarding upstream.
+				crate::controllers::jobs::env_from_secret_name(
+					"PGRO_REGION",
+					source.secret_name(),
+					"region",
+				),
 				EnvVar {
 					name: "PGRO_STATS_CALLBACK_URL".to_string(),
 					value: Some(proxy.stats_callback_url.to_string()),

src/controllers/restore/builders.rs

@@ -821,6 +821,14 @@ echo -n "$VERSION" > /dev/termination-log
 					value: Some(backup_type.clone()),
 					..Default::default()
 				},
+				// Region comes from the canopy-creds Secret the syncer
+				// materialises alongside this Job; the sidecar signs S3
+				// requests for it before forwarding upstream.
+				crate::controllers::jobs::env_from_secret_name(
+					"PGRO_REGION",
+					source.secret_name(),
+					"region",
+				),
 				EnvVar {
 					name: "PGRO_STATS_CALLBACK_URL".to_string(),
 					value: Some(proxy.stats_callback_url.to_string()),