Function render_secrets 

pub fn render_secrets(
    key_id: &str,
    secret: &str,
    github_token: Option<&str>,
) -> String

Render the host’s secrets.toml: the write-only S3 credential, [aws], plus an optional [github] token. Written chmod 600 by the caller; never printed. The token is the client-enforced singleton mirror’s credential — present only on the one host currently designated mirror.