[FIX] Move substitute files into a tmpl folder

Cleans up `envsubst` command and allows command to be re-run

tmpl/.sops.yaml

@@ -0,0 +1,6 @@
+---
+creation_rules:
+- encrypted_regex: '((?i)(pass|secret($|[^N])|key|token|^data$|^stringData))'
+  pgp: >-
+    $FLUX_KEY_FP,
+    $PERSONAL_KEY_FP