Task 1's implementer found sops.validateSopsFiles makes secret-key existence a build-time check (via manifest.json.drv), not an activation-time one as the plan assumed. Corrects Step 10 to reflect reality rather than leave future readers misled. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vbvwg3Qt2u9nbkEA3wL17S