[philband]

rekey encrypted from /dev/stdin without --filename-override, so SOPS matched that input path against the scope creation rule, found no match, and failed with "no matching creation rules found" before ever applying the explicit --age recipients. Every invocation hit this, because Prepare requires .sops.yaml to exist and SOPS runs from the scope directory.

Pass --filename-override with the declared scope source, mirroring init. Using Config.Source rather than a literal keeps it aligned with the creation rule, which is generated from that same value.

Add a regression test covering the encrypt argv. fakeSOPS now appends its argv recording instead of overwriting, because rekey invokes SOPS three times and the final verify call clobbered the arguments under test.

This pull request updates the SOPS encryption command to always use the --filename-override option during rekey operations, ensuring that SOPS creation rules are properly matched even when reading from stdin. It also adds a new test to verify this behavior and improves the SOPS test helper to append command arguments for more robust testing.

Bugfix: SOPS encryption command

• Updated the SOPS encryption command in newRekey() to add the --filename-override flag, ensuring the correct filename is passed for creation rule matching. This fixes an issue where SOPS would fail to match creation rules when encrypting from stdin.

Testing improvements

• Added a new test TestRekeyOverridesFilenameForCreationRules to verify that the --filename-override flag is correctly used during rekey, preventing failures due to unmatched creation rules.
• Modified the fakeSOPS test helper to append (>>) arguments instead of overwriting, allowing multiple invocations to be captured and tested.