feat: add sops+age encrypted environment store (dev/prod)

[ORESoftware]

Adds the per-repo sops+age encrypted environment store following the org convention from zed-pkg/zed-infra#10: .sops.yaml creation rules, a justfile that delegates to ores-sops plus an audit recipe, an annotated env/template.env.example schema, .gitignore env block, and sops-encrypted env/enc/{dev,prod}.env.enc.

Scope: this store holds developer/test credentials only (a dev registry token, a test Supabase project, a throwaway test account) so local cargo run / e2e sessions do not pass secrets through shell history. End users of the CLI keep supplying their own environment; nothing here changes runtime behavior.

Env schema (stored variables)

Variable	Class	Read by	dev value	prod value
ZED_PKG_REGISTRY	non-secret default	global --registry (src/cli.rs); default https://registry.zpkg.net	http://127.0.0.1:48090	https://registry.zpkg.net
ZED_PKG_AUTH_URL	non-secret default	global --auth-url (src/cli.rs); defaults to <registry>/shared-auth	http://127.0.0.1:48090/shared-auth	https://registry.zpkg.net/shared-auth
ZED_PKG_SUPABASE_URL	identifier	global --supabase-url (src/cli.rs), required with the key by src/auth.rs	http://127.0.0.1:54321 (local Supabase)	PLACEHOLDER
ZED_PKG_SUPABASE_KEY	secret slot (publishable/anon key, never service-role)	global --supabase-key (src/cli.rs, hide_env_values)	PLACEHOLDER	PLACEHOLDER
ZED_PKG_TOKEN	secret	global --token (src/cli.rs, hide_env_values); token precedence in src/config.rs	PLACEHOLDER	PLACEHOLDER
ZED_PKG_AUTH_EMAIL	identifier (test account)	zed auth login/signup (src/cli.rs)	PLACEHOLDER	PLACEHOLDER
ZED_PKG_AUTH_PASSWORD	secret (test account)	read_password() in src/auth.rs	PLACEHOLDER	PLACEHOLDER

Not stored (documented in the template): native-host publish tokens (ZED_NPM_TOKEN, ZED_CARGO_TOKEN, … from src/native_host_client.rs credential_env_vars) and the non-secret behavior toggles (ZED_PKG_HOME, ZED_PKG_FROZEN, ZED_PKG_CONTEXT_*, ZED_DEV_*, ZED_PKG_TEST_*).

Placeholders by policy

Every secret value in the committed ciphertext is a PLACEHOLDER-… string, per the credential-handling policy tracked in DEN-2836: real values must never transit chat, shell commands, or plaintext files — they are entered directly with just edit <name> (sops in-place edit, no plaintext on disk). sops dotenv mode encrypts values only, so variable names in env/enc/*.env.enc stay reviewable in diffs.

Deviations from the template

• No flake.nix added: this repo already ships a consumer-pinned Nix flake at nix/flake.nix (the reproducible package bridge), so the template's devShell flake was omitted rather than introducing a second flake identity at the repo root. ores-sops comes from the zed-infra devShell or PATH.
• The zed-infra-specific cf-verify Cloudflare recipe was dropped; there is no Cloudflare material in this repo's env surface.

Verified locally: sops -d round-trip on both files (names only), ENC[AES256_GCM present, just audit passes.

🤖 Generated with Claude Code

[ORESoftware]

Converted to draft as a merge-order guard.

This branch is based on pre-#228/#239main and GitHub currently reports it non-mergeable. Before promotion it needs a clean current-main replay, exact ciphertext/recipient audit, confirmation that only placeholders decrypt, and exact-head repository/security checks. No real credential should be introduced or transported through the PR.

[linear-code]

DEN-2969