feat: add profile secret reference schema and env resolver

[rmanibus]

Summary

• Implement RFC 0011 issue RFC 0011: Add profile secret reference schema and env:// resolver #87 foundation work for profile credential secret references.
• Add *_secret fields to profile store schema with YAML round-trip coverage.
• Add internal/secretref parser/resolver abstraction with env:// backend and typed errors.
• Validate secret references during profile load/save with actionable field-level error messages.

Files

• internal/engine/profiles.go
• internal/engine/profiles_test.go
• internal/secretref/secretref.go
• internal/secretref/secretref_test.go

Testing

• go test ./internal/secretref ./internal/engine
• go test ./...

Tracking

• Closes RFC 0011: Add profile secret reference schema and env:// resolver #87
• Epic: RFC 0011: Epic / Tracking issue for profile credential storage backends #93
• RFC: rfcs/0011-profile-credential-storage-backends.md

[codecov]

Codecov Report

❌ Patch coverage is 70.83333% with 49 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/cloudstic/cmd_store.go	71.05%	17 Missing and 5 partials ⚠️
internal/secretref/secretref.go	72.13%	15 Missing and 2 partials ⚠️
internal/engine/profiles.go	65.51%	5 Missing and 5 partials ⚠️

📢 Thoughts on this report? Let us know!