[JacobRoedel]

Summary

• make generated cron, systemd, and launchd artifacts run user commands directly
• keep apux.yaml for optional local verification, debugging, and evidence
• resolve declared secret references inside exported wrappers without serializing values

Verification

• cargo fmt --check
• cargo clippy -- -D warnings
• cargo test
• generated standalone cron wrapper execution smoke test