Update README to enhance documentation on secrets run functionality and improve diagram formatting

- Replaced static diagram with a mermaid flowchart for better visualization of secrets management.
- Expanded section on `secrets run` to clarify its operation as a pull → run → clear pipeline.
- Added examples and syntax details for using `secrets run` in various scenarios.
- Included information on automatic clearing of plaintext files after command execution.

secrets

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
+
 # secrets — encrypted env file sync between machines
 # Uses age key-file encryption + a private git repo.