cmc stdinOK never fired without a stdin flag; secret set uses alwaysStdin like release asset add. CLI e2e now covers piped secret set.