secrets: rename the vault helpers from env* to op*

They act on 1Password, not on the environment, so the prefix now says so:
opr (read), opc (create/update), opd (delete), opl (list), ops (refresh).
No behavior change. Checked the new names don't collide with any command
or oh-my-zsh alias, and verified opr/opl/ops against the real vault
(values compared, not printed).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

zsh/zshrc

@@ -76,38 +76,38 @@ grmb() {
 
 # Secrets from this user's 1Password vault, written by dotfiles/secrets/install.sh.
 # Reading a local 0600 file keeps shell startup off the network: nothing here
-# calls op. envc/envd refresh the file themselves; after editing the vault
-# anywhere else (the 1Password app, another box), run `envs`.
+# calls op. opc/opd refresh the file themselves; after editing the vault
+# anywhere else (the 1Password app, another box), run `ops`.
 _DOTFILES_CONF="$HOME/.config/dotfiles"
 [ -f "$_DOTFILES_CONF/secrets.env" ] && source "$_DOTFILES_CONF/secrets.env"
 
-# envr NAME           read one field straight from the vault
-# envc NAME [VALUE]   create or update a field (prompts, hidden, when VALUE is
-#                     omitted, which keeps the secret out of shell history),
-#                     then refresh and reload this shell
-# envd NAME           delete a field, refresh, and unset it in this shell
-# envl [VAULT [ITEM]] show every field and its current value (default: your
-#                     vault and item from op.env)
-# envs                re-fetch the vault into secrets.env and reload this shell
+# opr NAME           read one field straight from the vault
+# opc NAME [VALUE]   create or update a field (prompts, hidden, when VALUE is
+#                    omitted, which keeps the secret out of shell history),
+#                    then refresh and reload this shell
+# opd NAME           delete a field, refresh, and unset it in this shell
+# opl [VAULT [ITEM]] show every field and its current value (default: your
+#                    vault and item from op.env)
+# ops                re-fetch the vault into secrets.env and reload this shell
 #
 # The service-account token lives in op.env and is loaded only inside these
 # subshells, so it never lands in the environment of everything you run.
 _dotfiles_op() {
-  [ -f "$_DOTFILES_CONF/op.env" ] || { print -u2 "no $_DOTFILES_CONF/op.env; run: envs"; return 1; }
+  [ -f "$_DOTFILES_CONF/op.env" ] || { print -u2 "no $_DOTFILES_CONF/op.env; run: ops"; return 1; }
   ( set -a; source "$_DOTFILES_CONF/op.env"; set +a; "$@" )
 }
 _dotfiles_env_name() {
   [[ "$1" =~ '^[A-Za-z_][A-Za-z0-9_]*$' ]] && return 0
   print -u2 "$2: '$1' is not a valid variable name"; return 2
 }
-envr() {
-  _dotfiles_env_name "$1" envr || return
-  _dotfiles_op sh -c 'op read "op://$OP_VAULT/$OP_ITEM/$1"' envr "$1"
+opr() {
+  _dotfiles_env_name "$1" opr || return
+  _dotfiles_op sh -c 'op read "op://$OP_VAULT/$OP_ITEM/$1"' opr "$1"
 }
-envc() {
+opc() {
   emulate -L zsh
   local name=$1 value
-  _dotfiles_env_name "$name" envc || return
+  _dotfiles_env_name "$name" opc || return
   if (( $# >= 2 )); then
     value=$2
   else
@@ -115,18 +115,18 @@ envc() {
   fi
   # [concealed] makes it a password field; an existing field of that name is updated.
   _dotfiles_op sh -c 'op item edit "$OP_ITEM" --vault "$OP_VAULT" "$1[concealed]=$2" >/dev/null' \
-    envc "$name" "$value" && envs
+    opc "$name" "$value" && ops
 }
-envd() {
-  _dotfiles_env_name "$1" envd || return
-  _dotfiles_op sh -c 'op item edit "$OP_ITEM" --vault "$OP_VAULT" "$1[delete]" >/dev/null' envd "$1" \
-    && unset "$1" && envs
+opd() {
+  _dotfiles_env_name "$1" opd || return
+  _dotfiles_op sh -c 'op item edit "$OP_ITEM" --vault "$OP_VAULT" "$1[delete]" >/dev/null' opd "$1" \
+    && unset "$1" && ops
 }
-envl() {
+opl() {
   _dotfiles_op sh -c '
     vault=${1:-$OP_VAULT} item=${2:-$OP_ITEM}
     printf "op://%s/%s\n" "$vault" "$item" >&2
-    op item get "$item" --vault "$vault" --reveal --format json' envl "$@" \
+    op item get "$item" --vault "$vault" --reveal --format json' opl "$@" \
     | jq -r '
         [.fields[] | select(.purpose != "NOTES")] as $f
         | ([$f[] | .label // "" | length] | max // 0) as $w
@@ -136,7 +136,7 @@ envl() {
         | "\($name)  \($lines[0] // "")",
           ($lines[1:][] | (" " * ($w + 2)) + .)'
 }
-envs() {
+ops() {
   "${DOTFILES_DIR:-$HOME/.dotfiles}/secrets/install.sh" \
     && source "$_DOTFILES_CONF/secrets.env"
 }

zsh/zshrc.local.example

@@ -36,7 +36,7 @@
 # Nothing to set here. Do NOT loop over `op read` in this file: that ran on
 # every shell. secrets/install.sh stores the service-account token in
 # ~/.config/dotfiles/op.env and writes the vault's fields to secrets.env, which
-# the managed ~/.zshrc loads. Use envr / envc / envd (see zsh/zshrc).
+# the managed ~/.zshrc loads. Use opr / opc / opd (see zsh/zshrc).
 
 # --- Proxmox -------------------------------------------------------------
 # One pair of credentials, several consumers: the proxmox MCP server