5 minutes in and an error has erased my secrets.yaml

> sops -r -i --add-azure-kv https://so...fe99 secrets.yaml
[AZKV]	 ERRO[0001] Encryption failed                             error="keyvault.BaseClient#Encrypt: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code=\"Forbidden\" Message=\"The user, group or application 'appid=04b07795-8ddb-461a-bbee-02f9e1bf7b46;oid=1052deae-c635-4cb8-a30c-2eff122aff2f;numgroups=2;iss=https://sts.windows.net/13de0a15-b5db-44b9-b682-b4ba82afbd29/' does not have keys encrypt permission on key vault 'sops-b5078e18c0c34221;location=westus2'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287\" InnerError={\"code\":\"ForbiddenByPolicy\"}" key=sops-key version=6e538f7c6d714d138226082070d1fe99


> sops -r -i --add-azure-kv https://sops-b5078e18c0c34221.vault.azure.net/keys/sops-key/6e538f7c6d714d138226082070d1fe99 secrets.yaml

silently succeeds...

> cat secrets.yaml

># oh, there's nothing there

I guess this is because I used -i, but still... I don't think this should be expected behavior I hope.

Start by reproducing the two sops commands against secrets.yaml, focusing on the -r -i and --add-azure-kv path shown in the report. Trace how an Azure Key Vault encryption failure is handled during in-place processing, then define a regression test that verifies the input file is preserved when encryption fails.