add keygen command

we also refactor env var/existence handling logic to centralize it

copy ownership and permission info

processed template will have same permission as source template

fix e2e test to use existing secrets files

publish workflow