fix(governance): stop shell-evaluating decrypted env values in sops-env (#1257)