Use the bundled green launcher against a non-secret colors.yml.
./green build
./green create --dry-run
./green create
./green check
./green kubeconfig
./green registry
./green delete
Read references/configuration.md before editing desired state. Put credentials
only in ignored .envrc.private as COLORS_PAR_*. Never export
COLORS_PAR_PROFILE, edit .colors/, weaken compute-prevent-destroy, or run
a real create/delete without authorization. .colors/<profile>/kubeconfig and
.colors/<profile>/registry/push/config.json are private generated
credentials; hand the kubeconfig path to consumer deployments, never its
contents.