why did this ever work

config/initializers/lockbox.rb

@@ -6,6 +6,9 @@ elsif Rails.env.development? || Rails.env.test?
   # generate a deterministic key for dev/test so encrypted data persists across restarts
   # this is NOT secure for production – always set LOCKBOX_MASTER_KEY in prod
   Lockbox.master_key = Digest::SHA256.hexdigest("hca-dev-key")
+elsif ENV["SECRET_KEY_BASE_DUMMY"].present?
+  # allow Rails to boot during asset precompilation without real secrets
+  Lockbox.master_key = "0" * 64
 else
   raise "LOCKBOX_MASTER_KEY must be set in production"
 end