Upsert one KEY=value line in .kamal/secrets. Never logs the secret value. Idempotent — same key/value is a no-op.
