Modularize secret providers behind a provider registry

[jimpudar]

Summary

• Introduce a provider-neutral secrets layer with SecretProvider, SecretProviderRegistry, and provider-qualified secrets.env mappings.
• Move the existing macOS Keychain lookup behind a macos-keychain secret provider and route secret injection through the registry.
• Update the default secret mapping format and documentation to support future providers like 1Password, AWS Secrets Manager, and libsecret.

Testing

• Added unit coverage for provider-qualified secret parsing, registry dispatch, duplicate/unknown provider handling, and the macOS Keychain provider behavior.
• Updated existing provider factory coverage to assert the secrets registry is present.
• Validation passed: typecheck, lint, and unit tests.