If an app has multiple staged secrets, is there a supported way to deploy just one without applying the others? If so, what is the documented safe procedure?
no, this is not possible. deploying secrets is simply performing a Machine update with the existing config, at which point it will pick up all of the new app secrets.
what is your use-case?