refactor(secrets): simplify local bootstrap

[altaywtf]

Summary

• remove the standalone secret-bootstrap test harness
• keep normal verification secretless
• constrain local setup to the fixed ignored output

Review aids

Input: maintainer-supplied encrypted dotenv
Output: fixed ignored dotenv, mode 0600
Acceptance: actual loader sees the expected environment contract, then cleanup removes the file

Risks

• Local live-test setup only; package and API behavior are unchanged

Verification

• pnpm verify
• shellcheck for the setup wrapper
• real ciphertext setup, environment loading, mode check, and cleanup passed without printing values

---

Summary by cubic

Streamlines local secrets setup by removing the standalone harness and enforcing .env.local as the only output. pnpm verify remains secretless; live tests still use maintainer-supplied SOPS ciphertext.

• Refactors

  • Removed scripts/secrets-setup.test.sh and test:secrets; dropped from verify.
  • scripts/secrets-setup.sh always writes .env.local and now errors if SECRETS_OUTPUT is set; keeps gitignore and 0600 checks.
  • Updated docs to reflect simpler pnpm secrets:setup flow.

• Migration

  • Run pnpm secrets:setup to render .env.local; do not set SECRETS_OUTPUT (the script will fail if present).
  • No CI changes; pnpm verify no longer runs secrets tests.

^{Written for commit 82a3b53. Summary will update on new commits.}

[Copilot]

Pull request overview

This PR simplifies the local secrets bootstrap workflow for live testing by removing the dedicated secret-bootstrap test harness and ensuring normal verification (pnpm verify) remains secretless, while constraining secrets:setup to write a fixed, ignored .env.local output.

Changes:

• Removed the standalone scripts/secrets-setup.test.sh harness and dropped it from package.json scripts / verify.
• Updated scripts/secrets-setup.sh to always write to .env.local (no SECRETS_OUTPUT override).
• Updated contributor/operator docs to reflect the simplified secrets setup flow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/secrets-setup.test.sh	Removed the dedicated local secrets setup test harness.
scripts/secrets-setup.sh	Constrained secrets setup output to a fixed .env.local path.
package.json	Removed test:secrets and stopped running it as part of verify.
CONTRIBUTING.md	Updated contributor guidance for pnpm secrets:setup.
AGENTS.md	Updated agent/operator guidance for pnpm secrets:setup in live testing notes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}

[putio-releaser]

🎉 This PR is included in version 11.1.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀