secret handling with SOPS
generate new age keys with age-keygen -o ~/.config/sops/age/key-name.txt. encrypt local secrets with sops -e service-name/.env > service-name/.sops.env.
the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch (skipping the download when sops is already on PATH, e.g. on the custom studio/actions:ubuntu-latest runner image) and decrypts every *.sops.* file except .sops.yaml, writing service-name/.sops.env back to service-name/.env via a temp file and atomic move.