feat: provision fleet Actions secret and SOPS maintenance copy

[ORESoftware]

Purpose

Provision the nightly clients-fleet credential without placing plaintext in Git, pull-request text, logs, artifacts, or Linear.

One-time bootstrap

This internal same-repository PR starts a one-time encrypted handoff job. The runner publishes an ephemeral X25519 public key, accepts only an AES-GCM envelope bound to zed-pkg/.github:ZED_FLEET_GH_TOKEN, and keeps the matching private key only for the lifetime of that job.

After decrypting in memory, the job validates repository-administrator access and creates or updates these repository Actions secrets:

• ZED_FLEET_GH_TOKEN
• SOPS_AGE_KEY

It then creates env/enc/prod.env.enc through the pinned ORESoftware/ores-sops convention, verifies decrypt → env/dec/prod.env → relative root .env symlink behavior, locks plaintext, and removes the temporary bootstrap workflow and transport payload from the branch.

Durable repository changes

• canonical env/enc, ignored env/dec, and managed .env symlink policy
• pinned Nix dev shell with ores-sops, SOPS, age, Git, and just
• just env-init|env-use|env-dec|env-enc|env-edit|env-refresh|env-status|env-verify|env-lock
• variable-name-only .env.example
• operational and rotation documentation

Security properties

• the credential is never committed or posted in plaintext
• the encrypted PR handoff is single-run and authenticated with associated data
• the SOPS private age identity is stored only as an Actions secret
• the tracked SOPS file contains ciphertext only
• the workflow refuses non-admin credentials and scans the staged diff before commit
• temporary handoff comments and files are deleted after successful provisioning

Tracked under Linear issue DEN-3482.

[linear-code]

DEN-3482

[github-actions]

Fleet credential bootstrap completed without exposing plaintext.

• repository secret metadata: [{"created_at":"2026-08-11T19:24:58Z","name":"ZED_FLEET_GH_TOKEN","updated_at":"2026-08-11T19:24:58Z"},{"created_at":"2026-08-11T19:24:58Z","name":"SOPS_AGE_KEY","updated_at":"2026-08-11T19:24:58Z"}]
• SOPS public recipient: age1aez62ya8qm4cj7zmfnps7jkjtfka28afzs2ycynpkeepp2dl8u0q9lnuqq
• encrypted maintenance copy: env/enc/prod.env.enc
• local activation: just env-use prod

The one-time bootstrap workflow removed itself from the branch.