secrets: grant strong access to hello.yaml and gitea-pat.yaml

Standard baseline for an enrolled workstation-class client, matching
mac-mini/republic-laptop/etc: the bootstrap decrypt-test secret plus
the write-scoped Gitea PAT so strong can push to the wiki repo on its
own (homelab client add/remove, wiki edits from that host).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

secrets/hello.yaml

@@ -1,58 +1,62 @@
 greeting: ENC[AES256_GCM,data:eNMtZcpv04PHl/lGBZGBp7xAcO/5Sw==,iv:A4jtwePX0p/eDTP5+ztfV6gege9RwdPfLBY2N+DPfx0=,tag:MU8HpvLt/PUrNMw7BNUVIg==,type:str]
 phase: ENC[AES256_GCM,data:oIeo+kmkwaMDQrf10iY2PqOXJnq+hCIwOROQ86xgpkU7EJEeJKFssrNgbvQPHhIRZUZblQg9ZPamiZixQbYSTOXQSTWWu2FOnu6XFb24wCay,iv:TYKqoHcN+V324/roNopYhkwRpmv3cPrTFcmni5TajYQ=,tag:g8DXqEyORbQZ9B7PaFWgOQ==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
-        - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFMWU0K3V5NmZBNUk2TWNO
-            NmdRWjlBV3p5dWNhUWhTOFlEdCtkMVh5STJBCkwzbUNkenJjei9TVWVUMi81d0ZX
-            b3dTTnJudVZiV0YzajNPcXlUWUtxdWMKLS0tIEo1eUR3dmJQRWM0bHRtMFc5Q290
-            QmwyMk44SVBXQ0k5QjN3ZWtNS1FSWTgKcc/F1HfMfnwun+mIUq1Ds+DZPk7F1ohe
-            OIVt5aJliApDYesRJ14K1ZEdi4YqCqO+1cLi69iWKHNT3PcOYrepUA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWWkdsbVRjRUtTSFB3L01S
+            Q25RTnI3V3dtSm5EWWtJRDd4cFUvVnYyQUhjCnJtTHM2dm0vZWdsS1J5YkIrUlBk
+            NHJuWW1MdVFmVStJNElkUUNEUWVibkUKLS0tIGNkRkRpaVNVK0NRN3NVNWdVc2Zi
+            SnJUNjc4VTBkU1pMeE9CMmFUOXplajAKOHvgNGT3ba3HqqTeS617LRiTrzMp+zxc
+            7r545Rvjz8dlfmIFL+6xHh8WFj7MtTqCYZ/eKQgZZmnmX6LxsW7XqA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
-          enc: |
+          recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFNVUyajV1NFo5VFRyMDlG
-            dWFlRlVJZDlJTHdYOFJLRi81OU9BdkI2RG13ClMwLzFHQ0VxSXJzQ3V2S2pjVFRS
-            dEQvK1VMZ3FDZDkxSHdYb3NHeHE4QTgKLS0tIDNyZnV5OFVQNXVEUUlzK3RYMytt
-            Nnl5bTZuMWFLY28vZnBPWlFEYmFyK00KtwcrF0W91FIi+9nn8rF2G8xP2/ca2h3R
-            DagqhSmpaEC7QHtYGP9SAChhBrDuWdVtK0Gdbc4m/31gW7Fh815zfA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSei9SU3BvUGFXcUFSa3h0
+            VEViNkoxQTJ3eHlSeDdqcEd0dkJwTmpDbENrCkk1b0NsWVFnOWtNc0RNU2FyUDhC
+            UmZON0p3WFRTaERnUVFrU0p3ZzlsY3cKLS0tIGZmSE9UNmUvaFViZFYxZVFuOWtv
+            UTFhS0NnOVJHRHl2aythaENCV2M0SGMKgudovCO4ZW/zhZvDGe0aln7rK3Qury7a
+            xMAMfA2H7pzSu3nLRYuV2d0qHiOCHtWDEq0YL2IyFZK6M7CkzFcgDw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
-          enc: |
+          recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrTlFZYVFHZHNCUkllZC94
-            ZUFaS3JZTmdPclA4dlR0QklxMmVxNWNyZUhvCnVoY0YvWGlsbm9CaURkQzZUMTRs
-            ZVNmcDJxZWN2WG9nUUNtT0I4S1FIem8KLS0tIHBRWFhLN3p2Z0ZaWDEyeEw4WUhs
-            Z0RwQ290OWloQzh1eXVLenlrOTZyRzQKQEnY4KC8ReKGFDzklK/A6uIGMRIhMfLW
-            IzogPQiWYcDerMDd14kktBOcbjKRkI9gPSDZdmieS9z/wA5J37DNNA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJcEFtYlBZMnlYWmU5L0Zp
+            Q0tWeksyS1dvcTZFSmRBSGRrNGJDR0xyazJzCjV6aEdjWHVEY25ZN1VMajRPa0F6
+            NEdYSmNreXRUR0Y1S2E2VEFaNUhoajgKLS0tICt6RG9STlU2eHVyREZGcmJnWjE2
+            YmhXdU9GOWVMUEZQaTRhd3hVcTZSZE0KVroSqBqz7/zqOLmyVvxLefnCYJ23weQB
+            T7PgXxoaBQTtKrmzPhsxhHq9AZz5yzsGR2TMq5CPJiWfTrwAMRtrMA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
-          enc: |
+          recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSUlxdTFhR1dxaDU2MGdL
-            dVJoYVQwZm9DbEVOYXd4Ymd0dk56R283WjJFCi9MS05CVkxYY2NPc0pjeGNacm8w
-            ZDZGYUMrdDdKS05BckhoRDl4OTVxYjgKLS0tIHlPaUg4Yk96UVJacDFhSm1FaGZo
-            RVVSWVRteGcwN2dHOVhuWFpmU0p5aEkKXetFyc9PKB6dCljl0c/+JJrEyDvYJP0Y
-            1fbPf7WBJsLTaQgrjsGHU4wqlg0Se5GHMeriOPYaRjiL9locKW2SiQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnZUkvYU50MklrVVU4eWFX
+            enJVNHNpeFRrdDdVVHRHTTNQSnZreS9QYWdjClVPdXNCcXRTelhmSXRBd3hSeTBM
+            MHBuemdsWDl2ZTVKbU5ZVCtyai81WHcKLS0tIEdPeFNZYWgzVTB2QTR5MHRGU0dF
+            VXMwQk9FVDNBRW1Zck5CeTVxOWM4MGcKmDZ+hx0R3j2NYOk7NG4rbo7yfoSQ52JE
+            7JElgEXCoVpWPVzPEFKBAOGQFAPV/yOMVc25kRlAsQK9Aj60m+0DIw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
-          enc: |
+          recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwcWxaenJybWpqQ0RpM3ov
-            cEszZDI4YkswY1hpUmZDcmZ1Ky84N0xUUlh3CjJLcm5nVE0rSHhyeEhNSmFIaE00
-            RkpqVHFEdVR5VmdETnhnQ0JiSlFyNTQKLS0tIGNXdkMzaHBtTWU3azdDVm15NkpZ
-            TWlYZXdBYTROcHBqMCtFcEtJRUJtOEEKdBbB5a5teUnvIYaLJaLp3KZkEXhnkFor
-            pbnL/WrHQViLdu8pJ5nscIO9ryQt7dS6aAu6gP3Tbs7XdREOTFgKmg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkdER4aEFnWXJKR1VSVEVC
+            TFM3eUtzNU9CUWVUajdwcWthNFpUN0tKa0U4CmxQMXI5WGo1eDYyd3dRdHVnTzU3
+            bHlUTk56N0xaQ3NGUmdyVE04L1NHTWsKLS0tIGwzVVJ6UXVwTnY3SXI1dThGcDBv
+            ZXF5VnN0bElGdzZCQW54TnQrcGlBcGMKfO82YfNyoy416TEsqUzCopqxRENvaaGT
+            2MKYiyP4psmwrN7ClStTYX0FezxWNfuoGn+jDTejKTEvvaPTzJgjzA==
             -----END AGE ENCRYPTED FILE-----
+          recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMVUYxTzFoTnpXc081ZjFV
+            NTd4ZjRRRlNGVUFIQXZmUDN3Z3o4ZzBMSWgwCnh6NEYxVEZ3bnRUWmZ1WHoyMm9V
+            RHlwSVh0djNZdVBRb0ZtOC90MFYzK3cKLS0tIEtreUx1bk82djc3dERYa1dtL2Rz
+            TEdUMk5hYTZGa1BnWFhPOTUyTGJ6UG8KDnCXxwLwKMhCmiLvHdbma8w37rm5OeZS
+            YtEnnH28myCxi1YUYdsEaq1luv0e099Nd2sXuvtsya38+fC5bmLpOQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
     lastmodified: "2026-05-20T14:39:14Z"
     mac: ENC[AES256_GCM,data:CAoIW1sJkIbNoXMaVlXwfHdREzATNqDKpSN5ecaSiRARThB0/tcLNbkazXKyV1Rx5b+b3s+yCpBzwmNnH6ytaCzG5pKPcnfd6YJq7C5rm/EQHyaVGrPdBsSfqiz4yBXKClej//v3+qkD5Ls2PMppv5KmqigOKNQC/ot3ht2c7lM=,iv:eOmDDclksr9f9CDu6dJprSFwlWuoggzVFjyfqWf5Uhg=,tag:IU3sMlIi92ohM86zOIJdAg==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4