Function resolve_sops_dir 

pub fn resolve_sops_dir(
    install_root: &Path,
    config_dir: Option<&str>,
) -> PathBuf

Resolve the SOPs directory from config, falling back to the canonical shared default.

A relative config_dir resolves against install_root (the install root, config_path’s parent), matching the skill-bundles convention: the documented shared/sops value yields <install>/shared/sops, the same directory the web/RPC SOP author writes to and the CLI scans. An absolute or ~-prefixed value is used as-is (Path::join replaces the base entirely when the joined path is itself absolute). Unset, empty, or whitespace-only falls back to the canonical <install>/shared/sops — the same disabled sentinel SopConfig::runtime_enabled() recognizes, so the CLI/RPC scan root never diverges from whether the daemon built an engine.