finalize: read secrets from either vault file or env var

some lines are still reading env var only. move to commons:get-secret instead.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information