Commit Your Secrets to Git, Encrypted, with SOPS and age

The .env-in-.gitignore reflex pulls your secrets out of the one system that versions everything else. I tried git-crypt, then found something better. Here's how I now commit secrets to Git, encrypted, with SOPS and age.