- Webhook-triggered deploys now go through the per-service deploy queue
and default to no_cache builds (dflow convention — prevents stale
layer surprises on push).
- Boot sweep marks deployments interrupted by restart as failed instead
of leaving phantom queued/building rows.
- is_secret environment variables are AES-GCM-encrypted at rest
(enc:v1: prefix); key from SECRETS_KEY or JWT_SECRET fallback.
Existing plaintext secrets encrypt on boot; deploy/exec paths decrypt
transparently. Masked-echo writes preserve stored ciphertext.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
