sops-nix links each decrypted secret into
$XDG_CONFIG_HOME/secrets/global-env. The loader used the zsh glob
qualifier (N.), which matches plain files only, so it skipped every
symlink and exported no secret. Use (N-.) to match symlinks to plain
files as well.
