fix(deploy): generalize connector secret overrides

deploy/workspace-registry.env.example

@@ -1,6 +1,5 @@
 # Copy these non-secret registry settings into the installation environment.
-# Select at most one Git transport override and only the connector-secret entries whose matching
-# THT_WS_*_FILE bindings are declared. Every host path below must be absolute and normalized.
+# Select at most one Git transport override. Every host path below must be absolute and normalized.
 # Their contents are never committed, emitted by the API, or stored in the registry.
 THT_WORKSPACE_REGISTRY_ROOT=/data/workspace-registry
 THT_WORKSPACE_GIT_BRANCH=main
@@ -15,7 +14,10 @@ THT_WORKSPACE_GIT_AUTHOR_EMAIL=thoth-workspace-registry@localhost
 # THT_WORKSPACE_GIT_SSH_KEY_FILE=/absolute/path/to/git-ssh-key
 # THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE=/absolute/path/to/git-known-hosts
 
-# Host-only connector sources consumed only by deploy/compose.connector-secrets.yaml. The matching
-# THT_WS_*_FILE values belong in the separate workspace bindings env file and target /run/secrets.
-# THT_WS_PSD_CLINICAL_DWH_PASSWORD_SOURCE=/absolute/path/to/psd-clinical-dwh-password
-# THT_WS_PSD_CLINICAL_VECTOR_PASSWORD_SOURCE=/absolute/path/to/psd-clinical-vector-password
+# Generate an untracked connector override from arbitrary THT_WS_*_FILE bindings and their
+# matching host-only THT_WS_*_SOURCE paths. The generator records paths and variable names only;
+# it never writes secret values into the generated Compose file.
+# scripts/generate-connector-secrets-override.sh --bindings-env /absolute/path/workspace-bindings.env \
+#   --operator-env /absolute/path/operator.env --output deploy/compose.connector-secrets.local.yaml
+# Run Compose through scripts/compose-with-preflight.sh so relative, non-normalized, and mixed
+# SSH/HTTPS selections are rejected before Docker receives the invocation.