The committed root .env.sops is encrypted to dev keys only, and git
reset restores it on every deploy — leaving runtime tooling
(services.migration, CLIs) unable to decrypt secrets on the staging
host. After decrypting the staging env, re-wrap it to this host's age
key so post-deploy operations work.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

seed 002 was written against an older farm layout (Plot A/B/C with
maize/cassava/beans) and half-updated when 001_pilot_farm moved to the
syntropic design (lettuce/passion fruit/coconut/yam/eggs on Syntropic
Beds, Agroforestry Corridor, Poultry Loop). The validate_operational_
context() trigger correctly rejected harvest_events whose plot_id
differed from their crop cycle's plot:

- c07/c08 (Coconut Establishment, cycle 43): plot 022 -> 021
- c09/c10 (Indian Yam Cycle 1, cycle 44): plot 022 -> 020

Also rewrote all activity/expense/loss/observation descriptions to tell
one coherent story matching the current farm design.

Fixes KI-1.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

seed 029 inserts published stakeholder_feedback, but the 228 consent
enforcement trigger requires an effective canonical consent grant for
the party first — and the Adelphi operator party is only defined in
seed 105, which runs later alphabetically. Create the party and the
two consent grants (public_summary + stakeholder_feedback_review,
location-scoped) idempotently at the top of seed 029.

Also: env.py _sops_decrypt now tries both sops envelope formats
(plain for JSON-envelope files, --input-type dotenv for dotenv-envelope
files) instead of assuming one.

Verified on a fresh throwaway database: all 463 migrations+seeds apply
cleanly; then applied to staging (115 remaining seeds, 0 failures).

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>

The dual-attempt decrypt treated empty stdout as a failed attempt,
which broke the placeholder-credentials test flow (mock sops succeeds
with empty output; production validation should then reject the
placeholder env vars). A zero-exit run now returns its stdout
immediately; only non-zero exits trigger the format fallback.

Verified: reproduces the CI test scenario locally — SecretLoadError
'placeholder environment value is not allowed' raised as expected.

Co-authored-by: Syntropic Agent <syntropic-agent@kokonut.network>