- Replace sops -d --extract with bao kv get -field in workflow
- Remove .sops.yaml and encrypted proxmox.secrets.yaml
- Update .gitleaks.toml comment (remove SOPS reference)
- Proxmox token now fetched from OpenBao secret/infrastructure/proxmox
via AppRole authentication (atlantis role)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>