How a CLI launcher scans repos, matches them to projects, and injects the right secrets without .env files or hardcoded credentials.