[FIX] Move substitute files into a tmpl folder

Cleans up `envsubst` command and allows command to be re-run

.sops.yaml

@@ -1,6 +0,0 @@
----
-creation_rules:
-- encrypted_regex: '((?i)(pass|secret($|[^N])|key|token|^data$|^stringData))'
-  pgp: >-
-    $FLUX_KEY_FP,
-    $PERSONAL_KEY_FP