chore(scripts): move deploy+edit_secrets to scripts/, resolve repo root via git

- scripts now find the flake root regardless of cwd or where they live on PATH
- gitignore .env

.gitignore

@@ -11,3 +11,6 @@ result-*
 id_*
 age-keys.txt
 keys.txt
+
+# local env (PATH etc.)
+.env

scripts/deploy

@@ -17,7 +17,9 @@
 # Runs from a non-NixOS host too (nixos-rebuild / nixos-anywhere via `nix run`).
 set -euo pipefail
 
-REPO="$(cd "$(dirname "$0")" && pwd)"
+# Locate the repo root (flake dir) regardless of where this script lives on disk.
+SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)"
+REPO="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || dirname "$SCRIPT_DIR")"
 cd "$REPO"
 export PATH="/nix/var/nix/profiles/default/bin:$PATH"
 

scripts/edit_secrets

@@ -10,8 +10,11 @@
 # (default ~/.config/sops/age/keys.txt). Never commit that key.
 set -euo pipefail
 
-REPO="$(cd "$(dirname "$0")" && pwd)"
+# Locate the repo root (flake dir) regardless of where this script lives on disk.
+SCRIPT_DIR="$(cd "$(dirname "$(realpath "$0")")" && pwd)"
+REPO="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || dirname "$SCRIPT_DIR")"
 cd "$REPO"
+export PATH="/nix/var/nix/profiles/default/bin:$PATH"
 
 export SOPS_AGE_KEY_FILE="${SOPS_AGE_KEY_FILE:-$HOME/.config/sops/age/keys.txt}"
 if [ ! -f "$SOPS_AGE_KEY_FILE" ]; then