v0.32.0

• Add a declared value-source grammar so any string argument can accept its value indirectly — env:NAME, file:PATH#DOT_PATH, stdin, fd:N, prompt — with literal: as the escape for a value that begins with a recognized prefix
• Return credentials from a value source as SecretString, which renders as *** under Debug and Display and exposes the value only through an explicit expose_secret boundary
• Classify and reject a malformed or unaccepted value source in the CLI registry as cli_invalid_argument_value, before any config, filesystem, terminal, network, or domain I/O
• Let a host declare its own source scheme, validated against the reserved built-in names, so a host-read source appears in help and validation beside the built-ins
• Reject the prompt source on an argument whose id does not end in _secret, because prompting blocks on a terminal and suppresses echo
• Retire the afdata CLI's private --secret-from reader in favor of the shared value-source library, keeping the flag's opt-in shape and its released error wording
• Read INI entries appearing before the first section header as document root keys addressed by bare name, refusing a document where a root key and a section share a name
• Add file+FORMAT:PATH#DOT_PATH so a source can name its document parser when the filename cannot, with the format before the colon so a Windows drive letter is never mistaken for it
• Share one Format::from_cli_name table between value sources and the afdata CLI's --input-format instead of maintaining two