A Plain package can now ship top-level plain commands that run without loading your app — a new entry point group that skips runtime setup. That matters exactly when the app is the problem: plain env still runs on a fresh clone with no encryption key, right when you need it.