secret handling with SOPS

generate new age keys with age-keygen -o ~/.config/sops/age/key-name.txt. encrypt local secrets with sops -e service-name/.env > service-name/.sops.env.

the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch and decrypts every *.sops.* file except .sops.yaml, writing service-name/.sops.env back to service-name/.env via a temp file and atomic move.