#Openbao

ADR 0016: An OpenBao secrets vault, alongside SOPS

Secrets move into an OpenBao vault (SSO sign-in, identity-based access, audit); SOPS remains the bootstrap store.