RFC 0011: Documentation and CLI UX updates for profile secret references

[rmanibus]

Context

Once resolver support is in place, docs and command UX should guide users toward *_secret references while preserving current workflows.

Scope

• Update docs:
  • docs/user-guide.md profile/store sections
  • docs/encryption.md distinction between repo key slots and profile secret refs
• Add migration examples (*_env to *_secret).
• Update interactive store new UX to optionally capture/write secret references.
• Ensure --no-prompt behavior remains deterministic.

Acceptance Criteria

• User docs include practical *_secret examples for supported platforms.
• Migration guidance is documented and backward compatibility is explicit.
• store show / profile show display references only (no resolved values).
• Help/completion text updated if new flags/options are introduced.

Out of Scope

• Implementing native resolver backends themselves.
• Release/changelog finalization.

[rmanibus]

Parent epic: #93
RFC: https://github.com/Cloudstic/cli/blob/main/rfcs/0011-profile-credential-storage-backends.md