Bootstrap secrets before configuration loading

internal/app/plan_test.go

@@ -88,7 +88,7 @@ func TestPlanShowsRunAndSkipFromManifest(t *testing.T) {
 	}
 }
 
-func TestPlanDoesNotLoadConfiguredSecrets(t *testing.T) {
+func TestPlanSkipsAbsentConventionalSecretsDirectory(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	configDir := t.TempDir()
 	pipelinePath := filepath.Join(configDir, "pipeline.yml")
@@ -99,8 +99,6 @@ func TestPlanDoesNotLoadConfiguredSecrets(t *testing.T) {
   root: ` + workspaceRoot + `
 storage:
   backend: local
-secrets:
-  env_dir: ./missing-secrets
 whisperx:
   transcribe_url: https://example.com/transcribe
 seriatim:
@@ -128,7 +126,7 @@ inputs:
 	var out bytes.Buffer
 	err := Plan(context.Background(), []string{"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
-		t.Fatalf("Plan() error = %v, want missing runtime secrets ignored", err)
+		t.Fatalf("Plan() error = %v, want absent conventional secrets directory skipped", err)
 	}
 }