Summary

• update the secrets and PKI design to route GitHub token minting through github-token-broker
• update the AWS lab account design to describe token-plus-git or token-plus-curl encrypted secret fetches
• preserve local SOPS decrypt as the plaintext boundary

Validation

• npm ci in docs
• moon ci --summary minimal
• git diff --check