path	mode	owner	consumer	provision_task
/etc/zhct/secrets/vrrp.auth	0600	root:root	keepalived template injection	Q-101/Q-102
/etc/zhct/secrets/redis5.password	0600	root:root	haproxy and sentinel5 injection; reused by Redis role	Q-101
/etc/zhct/secrets/redis7.password	0600	root:root	haproxy and sentinel7 injection; reused by Redis role	Q-101
/etc/zhct/secrets/orchestrator-topology.password	0600	root:root	orchestrator config injection; reused when MySQL account is created	Q-101