Decrypt aesthetic-computer-vault/spaces/.env.gpg during deploy, scp the plaintext to /tmp/notepat-spaces.env on lith, source it for just the build command, and remove. Keeps S3 keys off /opt/ac/system/.env while still letting --sync-spaces push the versioned amxd + latest.json to s3://assets-aesthetic-computer/m4l/ notepat.com/ on every deploy that triggered a rebuild. Falls back to a build-without-sync (with a yellow warning) when the vault file is absent or GPG can't decrypt without a passphrase prompt — so deploys can still run in contexts where Spaces uploads aren't required.