Most of the answers here relate to the handling of credentials, probably due to this explicit question in the OP:
What's the best way to manage the "secrets" (passwords, private keys, MFA access) in this documentation to ensure it remains comprehensive without compromising security?
However, the title asks a different question, which I don't see addressed:
Developing a secure hit by a bus plan
The answer the that question is automation.
In devops, I find that most of the server side of the position falls into two categories:
Fix the infrastructure: Here is usually nothing to automate: every problem is different. In those cases familiarity with the infrastructure (servers, network, how the devs interact with the Git repos) is key.
Maintain the infrastructure: Create new VM instances, set up Apache, enable dev access to resources, etc. This is the place where automation is most visible.
Those the role of automation in the latter is obvious, the key to successfully fixing problems in the former is automation in the latter. The automated Python and Bash scripts serve as living documentation of what is expected of the servers and network: when the workflow changes it is the scripts that change. Git records changes that may be applicable to older servers, and git commit messages are explicit.
Finally, to address the issue of passwords, private keys, and other privilege management, I'll mention the least-effort probably-will-work method that I use. I simply keep it all stored in the ~/.ssh folder in my home directory. The owner of the company has my user password for logging in, and I personally create encrypted backups off site with the same password. His copy of my password is in an encrypted .zip file for which he chose the password and I don't know what it is. I created that .zip on my own machine, the owner just plugged his keyboard into my machine and entered his own password using his own keyboard.