fix: feat: consolidate secret stores — single granular secrets/*.enc, deprecate .env.vault.enc (#777)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

formulas/collect-engagement.toml

@@ -50,7 +50,7 @@ description = """
 Fetch today's Caddy access log segment from the remote host using SCP.
 
 The SSH key is read from the environment (CADDY_SSH_KEY), which is
-decrypted from .env.vault.enc by the dispatcher. It is NEVER hardcoded.
+decrypted from secrets/CADDY_SSH_KEY.enc by the edge entrypoint. It is NEVER hardcoded.
 
 1. Write the SSH key to a temporary file with restricted permissions:
      _ssh_key_file=$(mktemp)