Added filesystem-based secrets loading configuration

README.md

@@ -35,6 +35,16 @@ Pipeline config lookup for CLI commands:
   - `/usr/local/etc/narratio/pipeline.yml`
   - `/etc/narratio/pipeline.yml`
 
+Optional secrets-from-files config:
+
+- `pipeline.secrets.env_dir` may point to a directory of secret files
+- each top-level file with an env-var-style name is loaded as an environment variable:
+  - file name = env var name
+  - file contents = env var value (trailing newline/CRLF trimmed)
+- process environment wins: existing env vars are not overwritten
+- if configured, Narratio fails fast when `env_dir` is missing/unreadable
+- relative `env_dir` values resolve from Narratio’s current working directory
+
 YAML decoding is strict (`KnownFields(true)`), so unknown fields fail fast.
 
 ## Canonical Stage Order
@@ -199,6 +209,8 @@ Prompt IDs and profile IDs are configuration values. They are not hardcoded in a
 
 Do not put secrets in `pipeline.yml`. If API-key behavior is configured, use env var names only.
 
+If `pipeline.secrets.env_dir` is configured, keep only references and secret files there; secret values are still not written to manifests, generated configs, or Narratio-managed logs.
+
 ## Scriptorium Runtime Behavior
 
 Narratio integrates with Scriptorium through the public CLI subprocess contract: