Commit

I got sick of Claude accidentally reading my .env files that I put an explicit block on reading it and implemented .env templates using 1Password as the data store - so Claude can freely read my .env.tpl files (which in some cases can also get checked into source control), where it can see non-secrets and any secret is an {{ op://... }} reference. I have an envsync.py script that resolves those references out of op and writes the .env file, checking that it's not going to clobber anything that was accidentally updated by hand. It's working well on my dev machine.