LEA-279: Add first-class job secrets and redaction

[Yacobolo]

Summary

• add additive rtest.v1 secret references for environment and read-only file targets
• keep values in an external project-scoped store and resolve an operation snapshot only after FIFO admission
• keep values out of protobuf responses, SQLite/WAL, Swarm specs, audit payloads, console projections, and backups
• inject secret environment values in the entrypoint and mount file targets below /run/secrets
• scrub the exact resolved set from live stdout/stderr and durable logs across split and overlapping writes
• audit reference-name access, fail revoked references permanently, retry sanitized provider failures, and clean material before Docker release
• document rotation, revocation, running-job snapshots, backup/restore, and the trust boundary in ADR 0003

Stack

Depends on LEA-277 / PR #20.

Verification

• task test
• go test -race ./...
• go vet ./...
• task proto:check
• sentinel scan of SQLite, WAL, backup, audit, console/log projections, and operation cleanup
• CI

Linear: https://linear.app/leapstack/issue/LEA-279