0.24.0-alpha

Added

• Secrets, stage 1: {{CFSECRET_NAME}} placeholders (docs/SECRETS_DESIGN.md). Config files and
  patches can hold placeholders whose values live in encrypted *.secret.env files a layer lists
  under a new secrets field, so git-crypt only needs to cover .configtransform/**/*.secret.* and
  every other overlay stays readable and reviewable. Values follow the layer chain (later layers
  override), an environment variable with the secret's exact name overrides every file (for CI),
  and each format engine substitutes inside values with its own escaping. Previews keep
  placeholders and report each secret as resolved (with its source), MISSING or unknown
  (git-crypt locked); a new --reveal-secrets flag shows real values. A real run writes nothing if
  any secret is unresolved. --list shows the chain's secrets files. Secrets files must end in
  .secret.env and live inside .configtransform/, so the git-crypt rule always covers them, and
  a name defined twice (in one file, or in two files of one layer) is an error.
• Secrets, stage 2: whole-file secrets via a resource's replace (docs/SECRETS_DESIGN.md). A
  resource entry can name an encrypted *.secret.* file inside .configtransform/ that replaces
  the resource byte for byte — a Firebase service-account JSON, a certificate — with no merging or
  parsing, so any format works, binary included and with no format engine needed. A later layer's
  replace overrides an earlier one and supersedes earlier patches; a patch at or after the
  replacing layer is an error, and set refuses to patch a replaced resource. Previews print a
  one-line note unless --reveal-secrets; a still-encrypted replace file stops a real run before
  anything is written.

Changed

• A configtransform.json field the tool doesn't recognize is now an error. Before, unknown
  fields were silently skipped — so an older tool reading a layer that uses secrets would deploy
  unresolved placeholders without a word. From now on a too-old tool fails loudly. A layer with a
  stray or misspelled field will now fail to load; the error names the field.
• EnvFile (the .env grammar) moved from ConfigTransform.Env to ConfigTransform.Core, so
  *.secret.env files and .env resources are parsed by the same code. No behavior change.