Secrets that live in git - encrypted, no Vault, no sidecar

This is part of a series on building Orca, a single-binary orchestrator for the gap between Coolify and Kubernetes. Every orchestrator eventually has to answer: where do the secrets go? The default in...