docs(progress): S6-generate done (secret:// env valueless) (#42)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi

PROGRESS.md

@@ -56,7 +56,7 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - [ ] S3 AWS SM+SSM — TODO  *(ready: S1 in; localstack-testable)*
 - [ ] S4 Infisical (gated) — TODO  *(ready: S1 in)*
 - [~] S5 keyring + `secrets login/keygen` — **PARTIAL**: `secrets keygen` (age keypair, PR #39) done. Remaining: `secrets login` keyring (zalando/go-keyring + WSL2 in-mem fallback).
-- [ ] S6 post-render resolve + env injection + leak test — TODO  *(ready: S1,S2,C5 in — the secrets saga phase + the §7.5 leak test)*
+- [~] S6 post-render resolve + env injection + leak test — **PARTIAL**: generate now emits valueless keys for `secret://` env values + leak test (PR #41). Remaining: the saga secrets phase (collect→Resolve→Compose.Env).
 
 ### M5 networking (parallel track)
 - [x] N1 `internal/proxy` (Caddy route table + labels) — **DONE** (PR #15, `50e6686`)
@@ -103,3 +103,4 @@ satisfied phases; `--json` matches the spec contract; `down` decrements refs;
 - (night 2 cont.) **X6 trust probe merged** (PR #33) — `doctor` now reports local-CA readiness (mkcert/CA/certutil) as a non-fatal warning with remediation (decision-#3 self-verify for N2). **33 PRs merged this session.** X6 remaining: dns/shared doctor probes + a safe `--fix`. Frontier for `done`: S3–S6, provision saga phase (host-port coupling), N5 trust saga phase, X2/X3/X4/X5/X7/X9, G2–G5.
 - (night 2 cont.) **X2 merged** (PR #37) — the workspace dependsOn DAG in `internal/health` (BuildGraph, Cycle with path, stable topo Waves, RequireHealthchecks generate-time guard), pure/unit-tested. **Unblocks X4 (profiles) + X5 (orchestrate consumes Waves).** 37 PRs merged.
 - (night 2 cont.) **X2 + S5-keygen merged** (PRs #37, #39) — the health dependency DAG (cycles/waves/healthy-needs-healthcheck) and `secrets keygen` (offline age keypair via filippo.io/age, pairs with the S2 SOPS+age provider). Added the first new runtime dep (filippo.io/age, pure-Go; CI govulncheck clean — local go1.26.0 stdlib advisories do not apply to CI Go 1.25.x). **39 PRs merged.** Frontier: S3/S4/S6, S5-login(keyring), provision saga phase, N5 trust saga phase, X3/X4/X5/X7/X9, G2–G5.
+- (night 2 cont.) **S6-generate merged** (PR #41) — `secret://` values in env.raw/prefixed now emit valueless compose keys (no ref/value in generated files), with a leak test. Remaining S6: the saga secrets phase (collect refs → batched Resolve → Compose.Env). **41 PRs merged.** Frontier: S3/S4, S5-login, S6-saga, provision phase, N5 trust saga, X3/X4/X5/X7/X9, G2–G5.