feat(profile): distribution profile system (Phase 4)

[TechAlchemistX]

Summary

The v0.4 headline feature. A "profile" is a TOML config fragment served over HTTPS that teams publish once and every engineer installs with one command:

secretenv profile install acme-defaults
secretenv doctor  # now sees every team backend

Profiles land in <config_dir>/profiles/<name>.toml and are auto-merged into the active Config on load. They fill gaps — never override: the user's own config.toml always wins on conflicts.

New CLI surface

Command	Purpose
profile install <name> [--url <url>]	Fetch https://secretenv.io/profiles/<name>.toml (or --url), validate, persist
profile list [--json]	Show installed profiles with source + install time
profile update [<name>]	Re-fetch using If-None-Match for conditional fetch (no name = all)
profile uninstall <name>	Remove the .toml and .meta.json sidecar

Merge model

• User config.toml always wins.
• Profiles (in alphabetical order, in-memory via HashMap::entry().or_insert()) fill gaps.
• Malformed profile = error naming the offending filename; no partial load.
• Missing profiles/ dir = silent no-op.

Storage

$XDG_CONFIG_HOME/secretenv/
├── config.toml              ← user's own config (wins on conflicts)
└── profiles/
    ├── acme-defaults.toml
    ├── acme-defaults.meta.json   ← {source_url, etag, installed_at}
    └── ...

Fetching

Uses curl subprocess — consistent with the backends' CLI-spawn pattern, no new HTTP dep. Response body validates as a Config fragment before touching disk. file:// URLs are supported (for offline testing + local staging).

Security posture (v0.4)

Unsigned profiles over HTTPS. Signing + central index + list --available are deferred to v0.5+. Full threat-model discussion in docs/profiles.md §"Security considerations".

Tests

• secretenv-core: 5 new merge-semantics tests.
• secretenv-cli unit: 14 new tests (name validation, URL resolution, install/update/uninstall/list against file:// URLs, ETag parsing, RFC-3339 formatter).
• secretenv-cli integration: 4 new subprocess tests driving install → list → doctor → uninstall.
• Workspace totals: 505 → 531 (+26).

Out of scope (deferred)

• 3 sample profiles committed to secretenv-site/profiles/ (needs DNS live).
• Live end-to-end profile install acme-defaults against the canonical host (same blocker).
• Both close as part of Phase 7 aggregate release smoke.

Dependencies

Hits on main first: PR #53 (secretenv.io rename) and PR #54 (Phase 5 harness). Rebase onto those once merged — the overlap is the secretenv.io string in DEFAULT_BASE_URL which this PR already writes as .io.

Test plan

• cargo fmt --all -- --check clean
• cargo clippy --workspace --all-targets -- --deny warnings clean
• cargo test --workspace → 531 pass
• Manual end-to-end: install via file://, verify doctor auto-sees the profile backend, uninstall cleanly
• secretenv profile list --json emits parseable JSON
• secretenv profile install ../evil rejects the path-traversal name

🤖 Generated with Claude Code