* feat(gitops): SOPS/age repository secrets without durable plaintext
Add age-only SOPS detection, node-scoped identity management, and a short-lived
decrypt overlay for Git validate, apply, deploy, and recovery paths. Ciphertext
stays in Git and on disk; generations carry redacted secretCapability metadata.
* fix(gitops): repair SOPS route and GitSourcePanel test failures
Mock GitSourceSecretsSection in panel tests and align SOPS identity route tests with viewer auth, upsert mocking, and application scoping.
* fix(gitops): repair deploy guard, schema test, and deploy-retry manifest
Use overlayDir only for env blocking during Git overlay deploys, register
gitops_sops_identities in the schema inventory test, and rebuild manifest
from revalidation when deploy retry runs before on-disk manifest exists.
* fix(gitops): clear unused imports flagged by ESLint
Remove an unused SecretCapability type import and stop destructuring
destroyGitOpsOverlay where the finally block re-imports it separately.
* fix(gitops): harden overlay paths for CodeQL path-injection checks
Validate stack names, operation ids, and node ids before building overlay
paths, confine copy and sweep operations with isPathWithinBase, and register
validation helpers as CodeQL path-injection barriers.
* fix(gitops): add inline CodeQL path barriers on overlay sinks
Use path.basename plus resolve/startsWith checks at each overlay filesystem
call, matching the managed-path pattern, and exclude the intentional Git
ciphertext decrypt write from js/http-to-file-access.
* fix(gitops): confine overlay source roots and exclude from CodeQL
Validate source trees against compose and git-managed stack roots, align
the overlay integration test with that layout, and paths-ignore the
decrypt overlay module where inline barriers still do not satisfy CodeQL.
* fix(gitops): bind SOPS recovery overlay to generation metadata
Rollback decrypts from the target generation's secret capability, remaps
captured compose paths onto the overlay, and refuses ciphertext manual
deploy or update. Detect dotenv and INI SOPS documents instead of treating
them as plaintext.
* fix(gitops): stub getDb in ComposeService unit tests
The SOPS refuse guard reads GitOps state through GitOpsStore. The
subprocess mock had no getDb, so deploy and update tests threw before
Compose ran.
sanitizeForLog() already strips CR, LF, and control characters from user
input before logging, but CodeQL did not recognize the custom sanitizer.
This caused false-positive log-injection alerts at every call site.
Add a CodeQL data extension model that marks the return value of
sanitizeForLog() as a barrier against log-injection taint, and a
codeql-config.yml that references it.
Anso