Implement CLI version

[scale-tone]

Should be capable of at least unstashing secrets.
So that your code (e.g. e2e tests) can work seamlessly both on your devbox and e.g. on a build machine.