Small team secret management: when is "just commit .env to private repos" actually the right answer?