How do you pass a build secret without leaking it into image layers?

Use BuildKit's `--mount=type=secret` in a RUN instruction, which makes the secret available only during that specific RUN step's execution and never writes it into any image layer — unlike an ARG or ENV value, which would persist in the image history/metadata.