Add secret-backed action contract without plaintext reveal

[cbusillo]

Problem

Agents may need to use configured secrets to complete product/runtime tasks, but Launchplane must not expose plaintext secret values through agent context or convenience flags.

Scope

• Let agents inspect secret binding status without values.
• Let authorized agents request approved secret-backed actions, transfers, or bindings to allow-listed destinations.
• Require dry-run/apply shape and audit reasons where appropriate.
• Ensure responses show key names, counts, binding ids, validation state, and redacted evidence only.
• Keep any break-glass plaintext reveal path outside agent APIs.

Acceptance Criteria

• No agent-facing endpoint returns plaintext secrets.
• Secret-backed actions can be authorized without handing the agent reusable secret material.
• Destinations are allow-listed and policy checked.
• Logs, errors, issue comments, PR text, and context payloads never include secret values.
• Tests cover denied reveal attempts and approved redacted binding/apply flows.

Relationships

• Subissue of Make Launchplane a read-only agent context provider #379.
• Depends on scoped agent authz and redaction/provenance rules.