✓ Encrypted <CONFIG_DIR>/secret.enc.yaml via sops
