Secret cutover

Apps must read AWS Secrets Manager at boot. GitHub must stop being the copy a workflow can print.