We're on vacation until Thursday, so I apologize for giving only a very partial reply. I will try to add the remaining details on Thursday.
1. Lua hooks run on the lakeFS server, so we manage that for you.
2. There is no current way to export failure on running an action from lakeFS Cloud. Could you please open an issue so we can track this? Your particular context or even a use case would be very helpful to advance this.
3. I am not aware of any secrets support in lakeFS currently. Again, it would be great if we hear your use case!