Operational repos: adopt a .secrets/ convention (dotted dir, extensionless single-value files, tracked .example templates)

[ptr727]

Problem

There is no hub-documented convention for where an operational repo's own runtime secrets
live on disk or how the files are named. ptr727/HomeAutomation-Config had grown its own ad
hoc secrets/ directory (no leading dot) holding a shared env file plus one file per
credential, most suffixed .txt, with no committed sample/template files — so a fresh
checkout had nothing documenting what it needed to create.

This is distinct from spec/secrets.json (the CI/GitHub-Actions secret-name registry the
self-audit cross-checks) and from the already-documented host-scoped ~/.secrets/ convention
in that repo's OPERATIONS.md — this proposal is about the repo-scoped directory an
operational repo's own stacks/scripts read from.

Proposed convention

• Directory name is .secrets/, dotted — mirrors the existing ~/.secrets/ host
  convention rather than a bare secrets/.
• A single opaque credential file carries no extension (homeassistant_db_password, not
  homeassistant_db_password.txt) — the same reasoning already documented for ~/.secrets/:
  a plain-text file needs no extension on Linux, the same reason README/LICENSE carry
  none, and it is a security property (read, never sourced), not a formatting preference.
• A structured credential keeps its format's extension (.json for structured config).
• The shared env file is named for its purpose rather than bare .env (e.g. docker.env
  for a repo whose stacks are Docker Compose), so the name says what it configures and stays
  unambiguous if a second env-shaped file is ever needed.
• Every real secret file has a tracked <name>.example beside it, and only the
  .example files plus a README.md catalog are un-ignored, via a .gitignore negation:

  **/.secrets/*
  !**/.secrets/*.example
  !**/.secrets/README.md

  so a fresh checkout documents its own required shape without ever exposing a real value.
• <dir>/README.md is a catalog: one row per file — name, what it holds, what consumes
  it — plus a short note on how this repo-scoped directory relates to the host-scoped
  ~/.secrets/ convention when a repo also touches that.

Precedent

Implemented in ptr727/HomeAutomation-Config (repo-scoped .secrets/, plus bringing its
existing ~/.secrets/ files into the same extensionless convention for consistency) — I'll
link the PR here once it's open.

Ask

Worth documenting as the baseline convention for operational repos (GOVERNANCE.md /
OPERATIONS.md template content, STANDUP.md/RESYNC.md carry list), and worth an audit
check flagging a bare secrets/ directory or a .txt-suffixed single-value secret file as
drift once the convention lands.

[ptr727]

Implementation: ptr727/HomeAutomation-Config#46