I wish there was some secrets manager that would give me a per-project env file in somewhere ephemeral like /run (bonus points for it disappearing when the computer is locked).

Keeping a .env file around still is still a vulnerability if a device goes missing.

And in the env_file attribute in your compose yaml