Review notes against #14:

The PR body only claims discovery, listing missing files, recreate, force behavior, and non-secret scaffolding. The issue had several additional acceptance paths that need to be either implemented or explicitly deferred:

1. --paths filtering for explicit service directories/files.
2. --profile dev --materialize / --from-profile dev behavior.
3. env doctor with sensitive plaintext warnings.
4. Status listing that distinguishes example files, active plaintext env files, encrypted env files, and profile variants.
5. Backup behavior before forced overwrite.
6. Dry-run coverage for every mutating path.

Please update the PR body and tests to prove these are covered, or narrow the issue/PR scope so it does not close #14 prematurely.

Follow-up review after the push:

This PR is now draft, which is appropriate, but it is still not ready:

1. It still targets main and carries a cumulative diff. Retarget it to the correct predecessor branch once the stack order is settled.

2. The PR body still only claims the smaller env subset and does not mention the previously missing acceptance paths: --paths, profile materialization, env doctor, sensitive plaintext warnings, forced-overwrite backups, and dry-run coverage.

3. Because the body still says Closes #14, it currently overclaims completion unless those missing paths are implemented and tested.

Either broaden the implementation to fully close #14 or narrow the PR and split the remaining env requirements into follow-up issues.