ops-secret-sync

Detects and syncs Doppler→GitHub secrets drift. Compares last-updated timestamps between Doppler and GitHub repository secrets; flags stale GitHub secrets (defaults to >24h behind Doppler); and asks for user confirmation before making any changes. Safe to run in CI or locally.