feat(sops): add SOPS plugin for age key provisioning

[solcik]

Summary

Add shell plugin for SOPS (Secrets OPerationS) that provisions SOPS_AGE_KEY environment variable from 1Password vault items.

Supported CLIs

• sops - SOPS CLI for encrypt/decrypt operations
• helm - With secrets subcommand (helm-secrets plugin)

Credential Type

• secret_key - Age secret key (AGE-SECRET-KEY-...)

Provisioning

Sets SOPS_AGE_KEY environment variable with the age secret key.

NeedsAuth Rules

• sops: Authenticates for all commands except --help and --version
• helm: Only authenticates when secrets subcommand is used

Test Commands

# SOPS CLI
sops -d secrets.yaml
sops -e secrets.yaml

# Helm with SOPS secrets plugin
helm secrets decrypt secrets.yaml
helm secrets edit secrets.yaml

Use Case

SOPS with age encryption is commonly used for:

• Encrypting Kubernetes secrets (helm-secrets)
• Encrypting configuration files
• GitOps workflows where secrets are stored encrypted in git

The plugin allows developers to store their age secret key in 1Password and have it automatically provisioned when running SOPS or helm-secrets commands.