Local machine
OS keychain
Secrets for {{secret:NAME}} references, read from your keychain.
`wl secret set` stores a value in your OS keychain when one is available, otherwise in the encrypted local vault. At apply time a {{secret:NAME}} reference resolves from WORKLOOM_SECRET_<NAME>, then the keychain, then the vault. The keychain support is optional; without it the vault is used.