sync-dev rendered deploy/secrets/dev.yaml into /etc/thermograph.env
unconditionally. That path is dev's env file — and it is also BETA's, on the
box beta is still running on until the cutover completes. With the dev checkout
present, the next push to dev would have overwritten the live env file of the
environment currently serving beta.thermograph.org: its containers would keep
running (env_file is read at container start) and then come up on the next
deploy pointed at dev's database password.
The earlier run only escaped this by failing first on the missing checkout.
Gate the render on the host's own secrets-env marker, which provision-dev.sh
flips to 'dev' only after beta has vacated. Until then the job syncs the
checkout and skips the render loudly rather than failing, so the ordering is
enforced by the host's own statement of what it is rather than by remembering
to do the steps in the right order.
