secret handling with SOPS
generate new age keys with age-keygen -o ~/.config/sops/age/key-name.txt. encrypt local secrets with sops -e service-name/.env > service-name/.sops.env.
the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch, caching it under $RUNNER_TEMP/sops keyed on the version and runner platform so later runs skip the download. it then decrypts every *.sops.* file except .sops.yaml, writing service-name/.sops.env back to service-name/.env via a temp file and atomic move.