docs(homelab): require secrets sync after env changes

docs/operations/SECRETS_MANAGEMENT.md

@@ -98,19 +98,25 @@ What it does:
 
 Run this any time you create or update a stack's `.env` file.
 
+**Operational rule:** after any live `.env` change on PD, Doris or the operator must run the sync script and confirm whether it committed/pushed changes or reported the secrets repo already up to date. Do not treat live `.env` edits as complete until this sync step is checked.
+
 ---
 
 ## git-crypt on TrueNAS
 
-apt is blocked on TrueNAS Scale. git-crypt is installed via Docker and stored on the persistent dataset at `/mnt/docker-ssd/bin/git-crypt`.
+apt is blocked on TrueNAS Scale. git-crypt is installed via Docker.
 
-### Current installation (already done on PD)
+### Preferred installation location
 
 ```
 /mnt/docker-ssd/bin/git-crypt
 ```
 
-PATH is set in `/home/truenas_admin/.bashrc` and `/root/.bashrc`:
+### Compatibility note
+
+The original bootstrap script installs to `/root/bin/git-crypt`, while the newer runbook expects `/mnt/docker-ssd/bin/git-crypt`. Standardize on `/mnt/docker-ssd/bin/git-crypt` and make sure PATH includes that directory for both `root` and `truenas_admin`.
+
+Recommended PATH entry:
 
 ```bash
 export PATH="/mnt/docker-ssd/bin:$PATH"
@@ -175,6 +181,12 @@ On a fresh PD after reinstalling TrueNAS:
    git clone ssh://git@10.5.1.6:2222/fizzlepoof/truenas-stacks.git /mnt/docker-ssd/docker/compose
    ```
 5. **Redeploy stacks** per `DEPLOYMENT_CHECKLIST.md`
+6. **After any future live `.env` edit**, immediately run:
+   ```bash
+   export PATH="/mnt/docker-ssd/bin:$PATH"
+   bash /mnt/docker-ssd/docker/compose/scripts/sync-envs-to-secrets.sh
+   ```
+   Then verify the secrets repo is either updated and pushed or already unchanged.
 
 ---