Bootstrap secrets before configuration loading

docs/troubleshooting.md

@@ -717,7 +717,8 @@ Symptom:
 
 Likely causes:
 
-- invalid `pipeline.secrets.env_dir`;
+- missing, unreadable, or invalid explicit `--secrets-dir`;
+- invalid entries in the conventional `secrets/` directory beside the root pipeline;
 - missing credential environment variables;
 - invalid S3 endpoint/bucket settings.
 
@@ -730,7 +731,7 @@ env | sed 's/=.*//' | grep -E 'OBJECT_STORAGE|AWS|AUDITA|SCRIPTORIUM'
 
 Safe fix:
 
-- correct secret-file path and permissions;
+- correct `--secrets-dir`, secret-file type/name, and operator-managed permissions;
 - provide required env vars;
 - keep secret values out of YAML.