Carried over from secrets-provisioning-v2 (PR #15), which became unmergeable after heavy parallel hand-edits to main moved the merge base too far. Content identical to v2.
