Both secretKeyRefs (TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID) now read the Infisical-managed secret instead of the plaintext-in-git telegram-notify. Old secret stays as fallback until 3c removes its manifest. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>