simplify secret loading for cli

Value

• right now devs have to run a weird incantation (set -a && source .env && set +a) to make sure env vars are globally-loaded whenever running a CLI command
  • this is confusing and unnecessary, since we could just source .env in every cli script that needs it
• we would like these commands to "just work" so we can focus on other sysadmin tasks

Behavior

GIVEN an unlocked .env file (achieved with make unlock)

• WHEN a maintainer issues any boost command
• THEN all needed env vars will be in scope and no error will occur

GIVEN a locked .env file

• WHEN a maintainer issues any boost command
• THEN they will receive an error message prompting them to unlock secrets with make unlock