Warn the user when a file has multiple matching creation rules.

If and until issue #1467 is implemented, I think that sops should somehow warn the user when encountering this scenario as to not leave secrets in plaintext.

keys:
- &host_a age1...
- &host_b age1...
creation_rules:

- key_groups:
  - age:
    - *host_a
    - *host_b
  path_regex: secrets.yaml$
  encrypted_regex: ^(a|b|c)$
- key_groups:
  - age:
    - *host_a
  path_regex: secrets.yaml$
  encrypted_regex: ^(d|e|f)$

This sops file results in the following secrets.yml:

a: ENC[AES256_GCM,data:Rg==,iv:Tt8wYhErFHA6w2ZhPY8v60FI0BGEfFCWB0sIWSyJhzo=,tag:fl2TsFHF3IvkoL7Wic7iEA==,type:str]
b: ENC[AES256_GCM,data:WA==,iv:NvHemU5jQ1KyFadXmE2phbzhjE5KNP/LqySvDFh5ijE=,tag:a7iKrN4rJ56IR96+ZEBRog==,type:str]
c: ENC[AES256_GCM,data:Cg==,iv:xXnc1xy/PZxn3xhYMT3yDCoMnukyI7m9fE4V7uUcVzE=,tag:6RFD60VDallY235zvN2pfQ==,type:str]
d: d
e: e
f: f
sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtNGZhazB1eTFENUdsQzFC
            S0x1UThTdkZJbGVLZkZyanlzcHJaUTJjRHlBCmRMY3ZTOHdsTjhxSml1a053OHBv
            b0svRUlsblNIc2JOK2hWYmdGV1pUZzAKLS0tIDFqcGFzcHBhQWpBaUh2UjJJbU9T
            c1BobnpGOUFaNk13RVR6b2N1MXF2VmcK6K9lvHRPCnueUy+EmSNLauiLM6XcV383
            OiRfOXIZzADCQUjXyt+kXOiijM1DKj4CHx+IH04ldZsx7vASYR9RuQ==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1...
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOempDdTM0VmlxazlBdEFa
            NjdSTkNWVUdWbmFBMndMM3pqNlhsKzB5Y0I4CkV6OXpSWFkxZUZYWmtLdjZFang5
            MmRQZFBmLzlzOGo1V1ZjOEc2bTN0dU0KLS0tIHRSQzhucitJemNRd1Y1MHk5M0dK
            U3NqVVdGVjZEa3AwM044ZUNTSitGMncKOH/kIbOUrjDnLvGaA+18bV62oM5D0+HI
            tcv5TBJTP6G4ct6ww7ZVoipADzP4YTiTYR0+Q3CCLt27UxEKqnVARg==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1...
    encrypted_regex: ^(a|b|c)$
    lastmodified: "2026-06-15T06:14:11Z"
    mac: ENC[AES256_GCM,data:fzfjuIuYKMm8dYmhYSf3MVeoOUw421xsaG7oERmb/UyBrDj5jVnVWbHoLPzuxnz18gemMg/6mDXiZ39K5ueDFog5WWLrfn443aATGoOUdpcukVrOEpFbY1q2ehznChFA91Y8Xx/K4eKzcsRv0oH1tUZNfN6/KA5HUh06wrPA9Vw=,iv:E2Yf6SiIYVr4QdDYfsgn8iu2gD9tkUQAUm7NepXUc/0=,tag:axLbYkucrrtHqsRbBLGBMg==,type:str]
    version: 3.13.1

The keys d, e and f are unencrypted even though there is a matching rule in the .sops.yaml file. Until and if having multiple creation rules is implemented, I think that a warning to the user is a good idea as this can leave secrets unencrypted.

Reproduce the issue with the shown .sops.yaml creation rules and secrets.yml example, then trace the command path that selects a matching creation rule. Done means the user receives a clear warning when multiple rules match and the existing behavior is covered by a regression test.