feat(secrets): drive backup-repo PAT through SOPS + bridge it to Hermes env

[AlienWalker1995]

Problem

The last plaintext secret in the stack was GITHUB_PAT in .env (and embedded in the ordo-hermes-backup remote URL), used to push to the backup repo. Two issues:

1. It violated "all secrets in SOPS" — plaintext in .env + in a git remote URL.
2. Hermes couldn't use SOPS tokens it needs. Hermes expects tokens as env vars; SOPS secrets are deliberately kept out of its container, so when a token is "only in SOPS" Hermes concludes it has no access.

(The backup PAT is a different, classic token from the fine-grained SOPS github_pat, which has no access to the backup repo — so the backup push genuinely needs its own token.)

Fix — SOPS everywhere, surfaced via the entrypoint bridge

Bring the backup PAT under SOPS and deliver it to Hermes the way it expects (an env var), using the established Docker-secret → entrypoint-bridge pattern (same as DISCORD_BOT_TOKEN):

• secrets/github_backup_pat.sops — encrypted classic PAT (committed encrypted; safe).
• scripts/secrets/decrypt.sh — decrypts it to runtime/secrets/github_backup_pat.
• docker-compose.yml — mounts it on hermes-gateway (/run/secrets/github_backup_pat) + GITHUB_BACKUP_PAT_FILE.
• hermes/entrypoint.sh — bridges GITHUB_BACKUP_PAT_FILE → GITHUB_BACKUP_PAT env var.
• Backup remote → clean URL; a credential helper reads the SOPS-decrypted token (host + in-container). Plaintext GITHUB_PAT removed from .env.
• Docs (secrets runbook, secrets/README, Hermes SOUL): all secrets are SOPS-driven and reach apps as bridged env vars — never plaintext in .env, never in a URL; if a token isn't in your env it must be wired (SOPS+mount+bridge), not pasted.

No secret values committed — only the encrypted .sops blob and path references.

Validation

• Host git push to the backup repo works via the SOPS credential helper (throwaway-branch push/delete, no embedded token).
• Bridge present in the rebuilt hermes image; all preconditions met in the live container (secret mounted + non-empty + _FILE env wired) — identical to the proven DISCORD_BOT_TOKEN bridge.
• docker compose config validates; no plaintext secret in the staged diff.

Follow-up (operator action — can't be done headlessly)

The migrated classic PAT was previously exposed (plaintext in .env / remote URL), so rotate it: revoke the old token on GitHub, create a new one with Contents:write on ordo-hermes-backup, then sops re-encrypt secrets/github_backup_pat.sops + make decrypt-secrets. Because everything is now SOPS-driven, that rotation is a clean drop-in.

🤖 Generated with Claude Code