refactor(editors): standardize on helix, keep neovim as backup (#345)

secrets/Justfile

@@ -5,6 +5,9 @@ set shell := ["nu", "-c"]
 set working-directory := "../../codes/nix-secrets"
 
 identity := "/etc/ssh/ssh_host_ed25519_key"
+# `sudo` resets the environment, so the invoking user's `EDITOR` never reaches `agenix`.
+# Pin the editor here instead of using `sudo -E`, which would trust the caller's environment.
+editor := "hx"
 
 # List all recipes
 default:
@@ -12,10 +15,10 @@ default:
 
 # Edit or create a secret (interactive); pipe the plaintext to write non-interactively
 edit file:
-    sudo -E agenix -i {{identity}} -e {{quote(file)}}
+    sudo env EDITOR={{quote(editor)}} agenix -i {{identity}} -e {{quote(file)}}
 
 # Re-encrypt every secret after adding or changing a recipient key
 [confirm("Re-encrypt every secret in ~/codes/nix-secrets?")]
 rekey:
-    sudo -E agenix -r -i {{identity}}
+    sudo agenix -r -i {{identity}}
     sudo chown -R ryan:ryan *