#1966 Docs: local_encryption vault secrets are excluded from datastore sync — not documented anywhere

Problem

Nothing in the manual or skill docs states that local_encryption vault secrets (.swamp/secrets/) are excluded from datastore migration/sync. This exclusion appears to have landed as the fix for #650 (removing secrets from DEFAULT_DATASTORE_SUBDIRS), but the resulting behavior was never documented.

Confirmed on 20260831.202137.0-sha.7401da9d: swamp datastore status --json on a repo with live local_encryption vaults lists directories [auto-definitions, definitions-evaluated, workflows-evaluated, config, data, outputs, workflow-runs, audit, telemetry, logs, files] — secrets and vault are absent from the managed set.

Without documentation, users (and agents helping them) reasonably conclude the opposite: that switching to a shared datastore (S3, GCS, etc.) risks syncing vault ciphertext (and per #650's original report, the .key file alongside it) to shared storage. That's exactly backwards from actual behavior, and it's a security-relevant gap to get wrong in either direction.

Proposed documentation

In the vault guide and/or repo/datastore guide, state explicitly:

• local_encryption vault secrets always live in .swamp/secrets/ and are never included in datastore migration or ongoing sync, regardless of backend (filesystem, S3, GCS, etc.).
• This is what enables a "shared workflow, per-user local credentials" pattern: a vault's definition (vaults/local_encryption/*.yaml) is git-tracked and shared across teammates, but each person's actual secret value stays local to their machine even when the rest of the repo's state syncs through a shared datastore.
• Cross-reference #650 as the originating fix/behavior.

Alternatives

None — this is a pure documentation gap, not a behavior change.