Secrets were implicitly active whenever secrets/omnixy.yaml existed. Gate
them behind an explicit omnixy.secrets.enable (default false) so a fresh
fork builds and runs with zero secret setup, and derive age.keyFile from
omnixy.user instead of hardcoding padreug. bohm sets the flag in its host.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
