Test-Server Deploy

⚠ Every key defaults to FAKE. Tick a key to ROLL only it into the blob. Real outbound keys on a test box can touch production services or spend money, copy ONLY the keys the test box genuinely needs, leave the rest fake. Generating a blob with real keys is equivalent to viewing plaintext secrets; only do it on a trusted workstation.
Secrets blob 0 real
Builds a .env blob to paste into the bootstrap secrets prompt. Opting a key to real requires the same reveal step-up as the vault (Layer 2 + 3).
Deploy SSH keys file-select only
Public keys (.pub) injected into new builds by the deploy pipeline. Set by file selection only - no paste, no typing. The private .ppk never leaves your machine. Pick which key a build uses at deploy time.
TEST BUILD —
PRIMARY MIGRATION —