'kots pull' doesn't preserve valuePlaintext

The admin console workflow to update files says to

• kots download
• make changes
• kots upload

However it's not clear where to make changes.

• If I make them in base, then do kots upload, those are reflected in the diff and applied. However if I then make config changes in the console, my changes get overwritten.
• If I make them in upstream, then do kots upload, the changes don't appear in the diff until I also make some sort of config change in the console.

The best solution I found was to do kots download --decrypt-password-values, make changes in upstream, and run kots pull <slug> --local-path <slug>/upstream --rootdir newdir --exclude-admin-console --license-file <slug>/upstream/userdata/license.yaml --downstream this-cluster. I could then upload newdir/<slug> (or say --rootdir . and update in-place) but the password values from config that show up in base have been changed in a way I don't trust.

That kots pull invocation isn't easy to figure out, and it doesn't appear to treat valuePlaintext correctly.

Start by tracing the kots pull command and how it handles valuePlaintext during the reported download, edit, and upload workflow. Reproduce the invocation with --decrypt-password-values, then verify that password values remain correctly preserved rather than being transformed unexpectedly.