secrets: grant strong access to hello.yaml and gitea-pat.yaml

Standard baseline for an enrolled workstation-class client, matching
mac-mini/republic-laptop/etc: the bootstrap decrypt-test secret plus
the write-scoped Gitea PAT so strong can push to the wiki repo on its
own (homelab client add/remove, wiki edits from that host).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

secrets/gitea-pat.yaml

@@ -5,58 +5,62 @@ scopes:
     - ENC[AES256_GCM,data:/UG/8LQD21l/Ca0wfEodKw==,iv:f3tW1ZNLLkzE5Oy8acQ6GfyDvzEH3++kp8duBOI8+Is=,tag:IgfhvEaX9EGyPHhr6FSAjQ==,type:str]
 note: ENC[AES256_GCM,data:vRDjHXh5fYlhwJ4LyS/hcqMGdS+Z/D1W2oH6NaJak/XRUr+nFVQqcXSH/zUgqEBWNrMv6j8n2Ouxex/q2mr+p3Ds1jfThJTobX/MFqMkxvxk0TmB7ucui7CDa4mcVgSo3wyhcaba2o3erObByZ3o2uay3mmqzAUdo/wy2bCgQTkTG9/xqVSf3EYuR1j/A+SAzSvpsOORMNUjC5NRP1DUL+3hZkPXsfkXuy7sV6T2vF+oOrbEI0WxR8o4/JcF1B/4ezFAJ+f+nukCMz6eSCwur/wHffbcYa8mtD6BIRuV1pTd/Zob8arhe2ir19MB0fR27E3UkcCwyCkQ+QWuGzisvciCPtwR4JidH7xOpPW+4AK3vqEjmpEeMSWlyxbZadQFuSi8f3bPH+8eB2h/UFvT0BU6xw==,iv:r2dUnKyUWhyafIeDIjHOdqh+PNFzGtVZfcHc2TAhvvI=,tag:Cmg6esU4mQ8/9UbIQQL/gw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
-        - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaRWN5ZzIrNCtYeVRVNWdB
-            b0M3SHF1WVRTZzhhZ3NqK0llaVQ4SWxvSndNClprREJjWm80aGViTktSbGV0ZjFJ
-            R2thaXNXLzM5UmY2UHhuYXNITys2eGcKLS0tIGJkZ0RJS1lFTUhCZFlQTmd6M0NH
-            d0N1RWRRNTkzcGR2Zit3cnN2TXd0dm8KpvHCBO1gejHD0okrivBzC0qmfcFDQgHY
-            8ZLi83Mv7PflCZpcv67d7mai1F89DGDCsoo7TMGHh6rNU+Mpy/g5+A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2S0ZRV3BRSmhWaEViRDJG
+            RnhlS3NUZTd2N2dLL0ZQb1dGa09IUDIvUVZRCmVIN24zMnQ1ZUtpQnF1T3REL0ZM
+            WDBVbC9tWis0cnMwTFkrak9MS2duVXcKLS0tIDY1bHRMR0hiKzh2czVtalkxRito
+            VjNJci85VkkyWmhPdFIzOVA0TGxHUlEKRb9oG7s1l+qJx8zVN4vQ1qxwvsIhboid
+            8dcShpX3NIKYQH7dhQAM23StMp6eRNUGXB9eEkIGqlQJB3AirC0XKg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
-          enc: |
+          recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2YVQ0WnVDUEl3eU1kdGw1
-            aE81eU9iUExJZkg2ZElNR3Z6b3VCWkZSNHk4CkVGZFVZUnpxZEZRd2t3eDBhcmd3
-            VWIwSGhWS2JKSXQ2K0xva1NTYVB5bDAKLS0tIEFEc0Q4TXBXeWV6eW93eWxSMkdM
-            TllXK2xIL0R6T3dHOGdDNVdDTzdycHMKntYg1r5tOHWxpkce89ixirQBOBpIdAuN
-            PBAdd7vY9zL4tq+AB5Goz7gj2I56Fw3tM970YX/JaThCCiyquk2OPQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpQ0NmSldIcGVpekMxUFgw
+            cWpNOHpHek43dXlUVDFOWmFkZTlvUmdGZ3hZCkFhYUVwcmRYblVNaEkySTZIMUtG
+            RGhEMmUweHFyMVhlV3BzYllxSkN1eTQKLS0tIDNsalJkZWR2U29LbHROWVNLOWRr
+            N1R4S2d5VjNUeWtXWkJlSXBTUExiTEUKKqvErCTKMuYFrndXRTGFaHCE4UKD5PsA
+            0X6xKiMTK/6tQAEpaK06zihYnEp8X+N9z0O4hxzZbtHywrBkMsxR8Q==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
-          enc: |
+          recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDTnlKU2J0RFU0YU43TzJt
-            MGpQdy9Gb1J5cnd2K2Nvc0FnTUVCSzZudHpvCndmUThtaStCTWFqUzhMVlZ3dmZZ
-            ZHpsTUFmWEVCYWRpT29RNHRVSk5iQlkKLS0tIERpY1RUalA4UkQvSFR4SXNlZ3Z0
-            VG1xSDJCV0ZZR3gwczcxYlNsLzArOVkKvnPBHgk24SBvAsQWw+2FxCVLUdKMNyb3
-            D/Zk0EnwdT6JitDTHcQ2PlDoKBSK6BpW2Bk1gnaC9doiXSz6ykziWw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGNy8wN3hQY1FJU09uek1P
+            N3p0Zm9LT1dZVmpQTGtDbEN4WGRTV21zUVQ4ClJQdWhzU0ZxbDllTHFtekthZnJz
+            WlZyN3NLc0thS3hkaUhML2oxcXM4U1UKLS0tIFUvSVFWb1dmdWJlZDhXVVlVcDl1
+            NERoUEZHdnF2MmhqS255M1ptMW9nYmsK8oEzGVaHg6TFg6lciRweWU3fMPJ6YCwE
+            KDX6I2Y6qbIJtTwhaYlgjBIZoQSVvRwkvLdi/q/WUPtXYtn++8bjrQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
-          enc: |
+          recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Y2c3Z1NUT0NxQlpabTlP
-            SGtwK3JwcHorUDRXKzlFTjBhUno0SUsrK0VzCkdVQzAzSHJuRG9BRmJ1QW9aWFk0
-            MHcxL044b2VxYnpOTlJtNFN3NjNsek0KLS0tIGovbGtSOWdmclVKMytHZU5tUmhl
-            WFJLbFVlQjQ5U2pQenhWN1dUd1dWcUUKxb2yYZFys0AqY7+M0/gTIDK+1Bl0FIEj
-            DSqbAb2UYfNXKVEScJl4QeRLEYuTUKejD0WT4cYJzyjRAZzc7PnykA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySXZ4ZExlRkQrTmhwSG9O
+            SjZuREplSEN2OFArdFE1M2ZocnVYVkRKaGpRCnBML3ltNVpMV3NTdXNxd01hMGhh
+            KzN2SjhBdkVYRUlsY3BoV0tqYXM0TVkKLS0tIFR6blI4Y3Y5dlQ3alIzcUw5M2h6
+            bXphandFODVQbDhJUzdZOFBHZjBZNFEKxLLbNbd7WQm/+2vSoTH+HIOL3nASwlGH
+            bxoc47XhNXVnY2aeDsL96WOdE6pZearD++c7Da8zOcZUK/poKILWcw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
-          enc: |
+          recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRU0RhSWZpTVdFelVTeXF1
-            aXhPSGFLdWxMQ2J6UkVEQlN5aUJLYm0xN21ZCnhTYWpvQ1B1Z0dnamQ5SWk3NjVR
-            bGs5TGdZb2NkVkROS0hYQ2ZDVXpIWVEKLS0tIENyblo2L203OUNISUVKMkhXWmg1
-            NllKUW1mUVRldU03RUM1dThUeDJ5WjAKiy7aGBpQImoMdmFkNwR33Aksx8YDrjOg
-            DfOpNOiGHWWNfmLHngvGKzCwjqV0nsl1rM2khXcZ21w/9L8USNCceQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzOHFuNnFMT3U3dlZTVkVW
+            VVRLQkNPZEZ0S1hPSmdpdHJuU3dkUWt4eDNrCmRwTCtJUEZlSGNwYjUvVXRNRlBr
+            NFVoZ05HdS9ZRGcyRGo0dUl0RHdwN0kKLS0tIFFYc1VvOG5hNGp1bEx1ZW1IT1E0
+            bnRqNDRrQ202cnI1RHI0dkRqa3Rmb0EKj3NcVcTIa+rf2OFev3y+xmeQzV9BRkZN
+            4bXCPXNO1eNvA1bP8i8ha71X1KuIotWPiPssjEodREMyDMq7L+F24A==
             -----END AGE ENCRYPTED FILE-----
+          recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4U0ZoWTVrZXpCYzZMTDN4
+            c1dkMTdEd0V4b1paUU4wMlo1eURESng3NERjCjJGaHdmeHhzKzNyeFVXVFRkUEVk
+            VG02eEtaUnBSdVhVUk9lWUFXZjFEYWcKLS0tIFVrU3M0b29tYlNBQWVXSjlLeENj
+            TWdSY3BLNFkxWXNVY1VFSWZQL1pKbzQKxXPpqmfwtHbr+0DTeG5dZX2ihj1Ogb61
+            3wscc5WFDlrR/Jv4xvx/jFYxPxQHQcEg6fnS+pxczO2jv+aBhrTiDw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
     lastmodified: "2026-05-20T16:24:18Z"
     mac: ENC[AES256_GCM,data:d3qcjEqpPIFeut634ImvISJLdit0MQWcdFYomrsqriqJ0NUKdyq3XCk85+vvPvDWikB4WEApk6HMXssSY8mhDci95q5Ssmr+JRAhLebMZjs9yXUf9A7vXpNFswmdldu3CKBiDrhm2GE08qUfsCkcf3jjihEqsfHhxMuWSd5fZpU=,iv:VZgvZ3bBArRChgRX38U6/43XoX5aTnts7Kd4S9spBPk=,tag:/5oOw5yvulvFT6KXv2zj0g==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4