Document the workflow in the deployment guide and ignore secret-bearing backups under deploy/backups/.