- appset: goTemplate, filename-based app names, .path.path IS the directory,
exclude apps/root from the glob (v3.5 git files-generator schema)
- remove empty Secret stubs: with prune:true they would overwrite live
secret values (openwebui, paperless, vaultwarden-admin-token, password)
- secrets stay cluster-managed, not in git