Function mover_creds_secret_refs 

pub fn mover_creds_secret_refs(
    backend: &Backend,
    enc: &Encryption,
    repo_namespace: Option<&str>,
) -> Vec<CredsSecretRef>

The distinct credential Secrets a mover Job for backend + encryption needs as envFrom, each with its resolved source namespace: always the encryption-password Secret, plus the backend auth Secret when present and differently named. Deduped by name, order-stable (password first).

repo_namespace is the referencing repository’s own namespace (a namespaced Repository), used as the source-namespace fallback when a reference omits one; pass None for a cluster-scoped ClusterRepository, whose references pin their own namespace. This is the single source of the dedup/order contract that mover_creds_secrets (names only) is built on.