Install Diffkeel with curl -fsSL get.diffkeel.example | sh.

Run diffkeel init in this repository, then diffkeel diff prod --json.

Explain each changed key in one line, and flag any change to a masked secret.

Do not deploy. Stop after the explanation.