Put a placeholder where the example carried a real secret

[thc1006]

example_eval_cfg.yaml and the README both carry a working team_secret. This replaces both with a placeholder.

-team_name: example
-team_secret: 3b4b842...
+team_name: your-team-name
+team_secret: paste-the-secret-the-organizers-emailed-you

A credential does not belong in an example, and the README already tells competitors the organizers will email them their own, so the placeholder says what to paste rather than shipping something that works as it stands.

No behaviour change. team_secret is only copied into the packed submission; nothing reads its value, and no test refers to it. Local CI is green: ruff, uv lock --check, 557 passed and 0 skipped with BPC_RUN_SLOW_TESTS=1.

@zuorenchen there is more to this than the diff, and it belongs on the private side. See ARRC-Rocket/BalloonPoppingLeaderboard#8, where I have put the details and a suggested order of doing things. This PR is the part that is safe to do while the round is running.

[thc1006]

@zuorenchen a question about timing, since #137 does not do anything until it reaches main.

TLDR: the secret is still on the repo's front page, because the fix is on develop and visitors see main. Would you like a v0.1.2 for it, or would you rather it waited?

I checked with the API rather than assuming, on the default branch:

README.md               still there
example_eval_cfg.yaml   still there

So the pair is as discoverable now as it was this morning. Merging to develop closed nothing for anyone outside the team.

develop is four PRs ahead:

#137	placeholder for the example secret	+10/-4
#136	the Unreleased changelog entries	+11/-1
#131	an ignored action field says why	+137/-12
#126	the launch step's control fields, documented	+5/-0

Nobody's score moves. I checked rather than assuming:

• the ActiveRocketPy pin is the same commit on both, 473447d5
• comparing the two balloon_world.py at the function level, only step and _usable_action_fields differ, and both only along the path where an action cannot be read
• _detect_pops, _segment_distance_squared_batch, reset and _wants_launch are byte-identical

So a competitor re-running the same agent on the same seed gets the same number.

Two ways I can see:

Cut v0.1.2 now. It is four small changes, none of them physics, and the secret leaves the front page today.

Or leave it for whenever the next release is due anyway. It has been public since v0.0.2 on 2026-05-30, so a few more days is not a change of kind, and you have already signed one release today.

I lean towards the first, but you are the one who names releases and you know what else is coming. Say which and I will open the PR.

The rotation itself is still separate and still yours to time. Notes in ARRC-Rocket/BalloonPoppingLeaderboard#8.

[zuorenchen]

I kind of did this on purpose: provide an example secret so users can test the evaluate & submit procedure. It also helps us debug when a user can't upload their results

[thc1006]

That is a good reason and I did not know it, sorry for taking it out without asking first.

TLDR: you make a stronger point on the private side and I think it wins. Say the word and I will revert this.

Being able to run the whole submit path without registering is worth something to a competitor evaluating whether to enter, and being able to reproduce an upload failure yourself is worth more than that.

You also asked, over on the leaderboard issue, whether removing the example pair helps at all given that every team already holds one. It mostly does not, and I have answered there rather than here.

This is on develop and has not shipped, so reverting is clean. I will leave it as it is until you say which way you want it.