docs: warn against printing decrypted sops secrets

Running sops --decrypt/edit_secrets --show and displaying the result
puts every plaintext secret in the file wherever that output lands,
not just the one value being checked. Point at `sops --set` instead
for adding/changing a single value non-interactively.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -59,6 +59,12 @@ Secrets (needs the admin age key at `~/.config/sops/age/keys.txt`):
 ./scripts/edit_secrets secrets/<host>.yaml
 ```
 
+**Claude: never run `sops --decrypt`/`edit_secrets --show` and print the result — that
+puts every plaintext secret in the file into the conversation transcript, not just the
+one you wanted.** To add or change a single value non-interactively, use
+`sops --set '["key"] "value"' secrets/<host>.yaml` (quote the value as JSON), which
+writes without ever displaying the file's existing contents.
+
 Test a service config BEFORE touching hardware — always do this for nontrivial changes:
 ```
 # x86 QEMU VM of mercury's DNS/DHCP stack (fast; validates pihole/unbound at runtime)