Harden SOPS editing edge cases

[luzanovdm]

What changed

• fix format-aware editing for dotenv so dotted keys remain flat and SOPS metadata paths are rejected before mutation
• support native post-quantum hybrid age recipients and multi-identity files
• make SOPS path rendering safe for quoted and otherwise unaddressable keys, keeping unsupported paths read-only
• preserve array semantics for removals, empty arrays, and structured replacements
• repair stale save-review and validation state after undo/redo
• harden package/release validation, bump the app to 1.0.1 (build 2), and document the supported edge cases

Root cause and impact

Several editing assumptions matched YAML object paths but not the actual SOPS CLI grammar or dotenv's flat data model. This could make valid dotenv edits fail late, target the wrong JSON key syntax, or fail when array lengths changed. The age recipient validator also predated native age1pq1… recipients. Release packaging additionally hard-coded 1.0.0 and did not verify the advertised universal binary.

The updated application validates these constraints before mutation, applies structured array patches safely through stdin, verifies the complete decrypted staging document as before, and refuses unsafe paths rather than guessing.

Validation

• Scripts/test.sh — 83 passed, 0 failed, 0 skipped
• shellcheck Scripts/*.sh
• actionlint .github/workflows/*.yml
• Scripts/package.sh
• unsigned 1.0.1 package ZIP integrity verified
• Release binary verified as x86_64 arm64
• commit signature verified locally