8.10But where does the decryption key live?

This is the critical part.

If you store:

encrypted secret
+
decryption key

in the same repository, you've accomplished very little.

Instead:

Git repository
    ↓
encrypted values only

Deployment environment
    ↓
decryption key

The key might be injected through:

environment/system property
deployment configuration
secret manager
CI/CD secret store

MuleSoft's documented pattern passes the decryption key into Mule Runtime as a runtime/system environment property rather than embedding it in the secure-properties file.