Save a redacted .env template alongside pushed secrets

keep push now saves a comment/structure-preserving, value-redacted copy
of the source .env next to the encrypted secrets, so context like "why
this exists" or "get this from X" survives ingest instead of being
silently dropped. keep pull --template retrieves it. Old vaults pushed
before this existed keep working (flat payload, no template) and fail
with a clear error rather than crashing if --template is requested.

README.md

@@ -116,6 +116,23 @@ keep push myapp/production --file .env.production
 keep pull myapp/production > .env
 ```
 
+## Templates
+
+`keep push` also saves a redacted copy of the source `.env` alongside
+the secrets — same keys, comments, and blank lines, values stripped.
+Comments explaining *where a value comes from* or *why it exists* are
+exactly the kind of context a bare key/value pair throws away, so this
+keeps it without keeping the secret itself around unencrypted anywhere.
+
+```bash
+keep pull myapp/production --template > .env.example
+```
+
+Vaults pushed before this existed just don't have a saved template —
+`keep pull --template` on one of those fails with a clear error instead
+of silently returning nothing. No migration needed; push again and the
+template gets backfilled from whatever `.env` you push next.
+
 ## Granting, revoking, rotating
 
 ```bash