Add devseal

This skill installs scripts in a devseal directory, which are used to support encrypted secrets via age, that can only be decrypted using the age-plugin-se and secure enclave on the host Mac.

Templates live beside this file under templates/.

For wire protocol and Mac age setup detail, see reference.md.

Purpose

The purpose of devseal is to ensure the following security model:

• The secrets are always encrypted at rest
• The secrets are temporarily retrieved in the context of a dev container
• The secrets can only be decrypted with user interaction, using Touch ID, on the host
• The key is stored in the secure enclave which would make "caching" future interaction difficult to achieve