Wrap ragenix's required flags in just recipes

[alycda]

ragenix -e secrets/personal/foo.age fails from anywhere in this repo, in two different ways that both look worse than they are:

• From the repo root: ./secrets.nix does not exist! — --rules defaults to ./secrets.nix, and ours lives in secrets/.
• From secrets/: No usable identity or identities — the CLI hunts for SSH keys in ~/.ssh, which the dev container doesn't have. age.identityPaths in home-manager/modules/git.nix is read by the agenix module at activation time; the ragenix binary never sees it.

So both flags have to be supplied by hand on every invocation, and omitting -i reports a missing key rather than a missing flag — which sends you hunting for a lost identity instead of re-reading the command.

What this adds

just edit-secret personal/git-config.age   # or secrets/personal/git-config.age
just rekey-secrets

• _age-identity resolves ~/.age/personal-key.txt (override with $RAGENIX_IDENTITY) and, when it's missing, prints the docker cp recovery line the container entrypoint already suggests — or names the override, when that's what's pointing at nothing.
• edit-secret takes the path in any of the four forms you'd plausibly type or tab-complete: bare (personal/x.age), repo-relative (secrets/personal/x.age), ./-prefixed, or absolute.
• rekey-secrets wraps --rekey, which needs the same two flags. It's the rarer operation — recipient changes, key rotation — which is exactly when you won't have the invocation in shell history.

Also carries a content update to the private agent-instruction overlay (secrets/personal/agent-instructions.age), which is what edit-secret got used for first.

Review round

Three follow-up commits, one per finding, all in error paths rather than the happy path:

• --editor is required, not optional. It advertises [env: EDITOR=...] in --help, but clap treats it as a required argument that merely defaults from the environment — so an unset EDITOR died on argument parsing with a usage dump. That's the same class of confusion the recipe exists to remove, and it fires wherever the session env is thin (non-interactive shells, or the failed-activation state docker/CLAUDE.md describes). Now passed explicitly, defaulting to hx.
• The path was interpolated as raw text. just substitutes into the recipe body rather than passing arguments, so just edit-secret 'x.age"; echo INJECTED; :"' executed the injected command — and any path with a space broke for the same reason. Fixed with quote(). Stripping only a literal leading secrets/ also meant the ./ and absolute forms got a second secrets/ glued on; both are handled now.
• The recovery hint ignored $RAGENIX_IDENTITY. It reported the path it actually looked at, then told you to place a key at the default path — useless when your own override is the broken one.

There's deliberately still no check that the target file exists: ragenix -e on a non-existent path is how a new secret gets created, so ragenix's rules lookup stays the gate. It also rejects a file that exists but was never listed in secrets.nix, which an existence check wouldn't.

Testing

• All four path spellings, from both the repo root and from inside secrets/: ragenix reports "wasn't changed, skipping re-encryption" and the tree stays clean.
• EDITOR unset now gets past argument parsing and launches the editor.
• The injection case no longer executes — the path reaches ragenix literally and is refused by the rules lookup.
• A missing identity fails through _age-identity with the right hint for each case (default vs. override) and a non-zero exit.
• rekey-secrets against all four real secrets: the armored encoding secrets.nix depends on is preserved, and every result still decrypts. That churn was reverted — rekeying rewrites ciphertext every run, so committing it would be noise.
• The overlay update was checked to decrypt and stay armored before it was committed.

Worth knowing

rekey-secrets rewrites all four secrets even when the recipient list hasn't changed, so its diff can't be reviewed by inspection — only by decrypting. That's inherent to ragenix --rekey, not something the recipe introduces.

[github-actions]

⊕ Entity-level changes

justfile

Status	Type	Name
-	chunk	lines 101-115
+	chunk	lines 101-120
+	chunk	lines 121-140
+	chunk	lines 141-160
+	chunk	lines 161-175

secrets/personal/agent-instructions.age

Status	Type	Name
-	chunk	lines 1-15
+	chunk	lines 1-20
+	chunk	lines 21-24

Summary: 6 added, 2 deleted across 2 files

_{functions and classes, not lines · sem}