Expand example secrets docs, refactor post-install hook to use 'onlyif'.