Secrets are a Server-side SecretSpec + keyring store with inject-all, no repo manifest
Status: Active (Matt, 2026-07-15)
Record: ../../agent/compass-agent-container-runtime.md#decision-2–secrets-store-secretspec–keyring-server-side-no-repo-manifest-inject-all