systemd loads EnvironmentFile before ExecStartPre runs, so the env file
could never exist in time. Replace with a single ExecStart wrapper script
that reads sops secrets directly and execs jirorian.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>