Read the Release Env File Through the Hub's Carried Readers #553

Summary

Read deploy/make-release.sh's env file through the hub-hosted readers from ptr727/ProjectTemplate#3505, rather than through an existence check and set -a; . "$ENV_FILE".

Work

1. Declare host-secrets in this repository's types in the hub's registry/repos.json, in a hub pull request.
2. Carry the hub's lib/sh to lib/fleet/sh with the hub's scripts/carry.py apply, from a feature worktree here.
3. In deploy/make-release.sh, source lib/fleet/sh/secrets.sh, check the env file with require_secret, and read each value with read_env_value instead of sourcing the file into the script's shell.

Done When

deploy/make-release.sh reads its env file only through the carried readers, and the hub's carried-trees gate check reads the copy as current.

Ordering

This pairs with #550, the env file rename. Whichever lands second updates the path the other names.

Blocked On

The hub release that carries ptr727/ProjectTemplate#3512, since a carry reads the hub's main.

🤖 Generated with Claude Code