pub fn write_env_skeleton(dir: &Path) -> Result<PathBuf>
Seed ~/.config/bupha/env with the secret names (empty values — never invent secrets).