fix: prepare secrets from pinned La Suite Docs base

runner/harness/abra.py

@@ -126,6 +126,25 @@ def recipe_checkout(recipe: str, version: str) -> None:
     subprocess.run(["git", "-C", path, "checkout", "-f", "--quiet", version], check=True)
 
 
+def ensure_secret_versions_from_recipe(recipe: str, domain: str) -> None:
+    """Fill missing secret versions after a pinned checkout.
+
+    `app new <recipe> <version>` creates its .env from whichever recipe tree was
+    checked out *before* it pins the version. A removed secret in the current
+    recipe can therefore be missing from the older base's .env. Keep existing
+    assignments, including versions intentionally changed by install hooks.
+    """
+    sample = os.path.join(recipe_dir(recipe), ".env.sample")
+    if not os.path.isfile(sample):
+        return
+    pattern = re.compile(r"^\s*(SECRET_[A-Z0-9_]+_VERSION)=(v[A-Za-z0-9._-]+)")
+    with open(sample) as fh:
+        for line in fh:
+            match = pattern.match(line)
+            if match and env_get(domain, match.group(1)) is None:
+                env_set(domain, match.group(1), match.group(2))
+
+
 def has_lightweight_version_tags(recipe: str) -> bool:
     """True if the recipe's local checkout has any LIGHTWEIGHT (non-annotated) version tag.