Secrets for jobs
runtime secrets set NAME --jobs keeps a copy a job puts into its run's environment (--secret NAME on runtime job create); with --host as well, one command stores it for sandboxes and jobs alike. The jobs copy can be rotated and read back; the sandboxes' copy still never can.