docs: fix drift from the 0.2 changes and give secrets a page

[refsz]

A pass over every doc page against the source, before the 0.2 tag. Every claim below was checked against src/, not against the prose.

Broken for anyone who pastes it

README.md:22 called shellRaw(). #30 removed it. The README's only code sample - the one GitHub and Packagist render - was a guaranteed Error: Call to undefined method. docs/index.md already had the corrected version; the README never got it, and as a result never mentioned exec() at all.

docs/tasks.md promised timeout has no default. It has one: ShellExecutor::DEFAULT_TIMEOUT = 300.0, and TaskContext passes 'timeout' => $options['timeout'] ?? null, so null falls through to 300 seconds rather than disabling the limit. A ten-minute migration would have been killed at five minutes against documentation saying that could not happen. Now states the default and that tty: true is what removes the limit.

docs/tasks.md passed $ctx as log()'s third argument. The signature is log(string $level, string $message, array $context = []); passing a TaskContext is a fatal TypeError.

Secret masking was nearly invisible

It is the feature 0.2 exists for, and it had no page, no nav entry, no index card, and no mention in the README - the string "secret" did not occur in that file. The only prose lived in the middle of variables.md, reachable only from inside another page.

It is now docs/secrets.md:

• what masking does comes first, with a worked exec() example showing the echoed line masked while curl receives the real token
• the caveats stay, moved under a heading that frames them honestly: masking is a display filter, not an information-flow guarantee
• adds the one trap the source implies but nothing stated: type: env is secrets-only. variables.dynamics rejects it (ConfigValidator allows command|git|script|system|composite), so a reader who just learned type: env from the secrets section would hit a validation error.

variables.md keeps a short pointer, and the cross-references in tasks.md, configuration.md and listeners.md follow the move - mkdocs build --strict would fail on a stale anchor, and passes.

Smaller corrections

• ExecutionResult table was missing command (the property holding the unmasked command line, which the secrets page warns about) and getOutput() / getErrorOutput() / getCombinedOutput().
• --version and --help were undocumented, while CONTRIBUTING.md tells bug reporters to run sputnik --version.
• The resolution-priority list did not mention secrets. They sit outside it: a colliding name is a hard config error, so there is no priority to state, and they resolve lazily.
• docs/environments.md showed sh -c "drush sql-dump | gzip > dump.gz" as if Sputnik echoed those quotes. ShellExecutor::display() joins argv with spaces and makes no quoting promise. The quotes still usefully show the argument boundary, so they stay with a note.
• Terminal mockups in README.md, docs/index.md and docs/quickstart.md said 0.1.x; the README's also dropped the emoji and the v that SputnikOutput actually prints. Now 🛰 Sputnik v0.2.0.

Checked and deliberately left alone

• No stale shellRaw anywhere else; the one hit in the tests is a comment noting its removal.
• No stale {command} placeholder; the one hit is a negative test asserting the old form is rejected.
• Every executor: in the docs is already a list, and environment.shell is documented and matches DEFAULT_SHELL = ['sh', '-c'].
• The exec() vs shell() explanation in tasks.md is correct, including the Go-template escaping warning - {{range .items}} genuinely does not match the parser's pattern while {{end}} does.
• PHP 8.3 is consistent everywhere; the only 8.2 hits are transitive constraints in composer.lock.

🤖 Generated with Claude Code

https://claude.ai/code/session_018CTvnzcNYmFgm2HQcm821A