docs: secret sync runs in test only
docs: hub BGP route gotcha for OpenShift egress
docs: sync write keeps unmapped keys
docs: add Secret-Sync page, point Azure-Environments at it