Designing repo-aware secret sync without committing secrets to Git