Carried over from secrets-provisioning-v2 (PR #15), content identical. Whole-file template render (hard-fail naming missing vars), env + Docker secrets shipped via ssh stdin only, sha256-checksum skip-if-unchanged, never prints a value. Stacks absent from the manifest exit 0 so legacy case-entries keep handling them.