secrets: add encrypted hello.yaml (bootstrap verification)

Encrypted to hubris + apps; expand recipients as new clients enrol via
'sops updatekeys -y secrets/hello.yaml'. Tests the full sops + age path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.sops.yaml

@@ -18,12 +18,11 @@
 creation_rules:
   - path_regex: ^secrets/hello\.yaml$
     # The "hello" secret is encrypted to every enrolled client so the bootstrap
-    # decrypt test works for everyone. Populated by the operator with the
-    # age_pubkey from each hosts/<name>.yaml after Phase 3a generates keys.
+    # decrypt test works for everyone. Add each new client's age_pubkey when
+    # they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`.
     age: >-
-      # placeholder — operator fills in after first issuance run.
-      # comma-separated age public keys, e.g.:
-      #   age1xxx,age1yyy,age1zzz
+      age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
+      age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 
   - path_regex: ^secrets/gitea-tokens\.yaml$
     # Workstations only.