docs(homelab): require secrets sync after env changes

docs/operations/SECRETS_MANAGEMENT.md

@@ -98,19 +98,25 @@ What it does:
 
 Run this any time you create or update a stack's `.env` file.
 
+**Operational rule:** after any live `.env` change on PD, Doris or the operator must run the sync script and confirm whether it committed/pushed changes or reported the secrets repo already up to date. Do not treat live `.env` edits as complete until this sync step is checked.
+
 ---
 
 ## git-crypt on TrueNAS
 
-apt is blocked on TrueNAS Scale. git-crypt is installed via Docker and stored on the persistent dataset at `/mnt/docker-ssd/bin/git-crypt`.
+apt is blocked on TrueNAS Scale. git-crypt is installed via Docker.
 
-### Current installation (already done on PD)
+### Preferred installation location
 
 ```
 /mnt/docker-ssd/bin/git-crypt
 ```
 
-PATH is set in `/home/truenas_admin/.bashrc` and `/root/.bashrc`:
+### Compatibility note
+
+The original bootstrap script installs to `/root/bin/git-crypt`, while the newer runbook expects `/mnt/docker-ssd/bin/git-crypt`. Standardize on `/mnt/docker-ssd/bin/git-crypt` and make sure PATH includes that directory for both `root` and `truenas_admin`.
+
+Recommended PATH entry:
 
 ```bash
 export PATH="/mnt/docker-ssd/bin:$PATH"
@@ -175,6 +181,12 @@ On a fresh PD after reinstalling TrueNAS:
    git clone ssh://git@10.5.1.6:2222/fizzlepoof/truenas-stacks.git /mnt/docker-ssd/docker/compose
    ```
 5. **Redeploy stacks** per `DEPLOYMENT_CHECKLIST.md`
+6. **After any future live `.env` edit**, immediately run:
+   ```bash
+   export PATH="/mnt/docker-ssd/bin:$PATH"
+   bash /mnt/docker-ssd/docker/compose/scripts/sync-envs-to-secrets.sh
+   ```
+   Then verify the secrets repo is either updated and pushed or already unchanged.
 
 ---
 

docs/planning/SCHOOL_INTAKE_PIPELINE.md

@@ -77,9 +77,6 @@ This gives Doris a simple handoff point after the Telegram conversation is compl
 
 ## Live work still needed
 
-- import/activate the new n8n intake workflow
-- import/activate the Paperless enrichment workflow
-- create shared Postgres database/user/schema
-- configure class profiles with real Paperless IDs
+- configure class profiles with real Paperless IDs / tag mappings
 - decide Telegram delivery wording/confirmation behavior
-- test with real ENGL + HIST documents
+- after any live `.env` changes for this pipeline, sync them into the encrypted homelab secrets repo (`docs/operations/SECRETS_MANAGEMENT.md`)