feat(secrets): add fail-closed credential custody

[willgriffin]

Closes #1202

Summary

• add provider-neutral ephemeral/durable credential custody with Warden/SOPS-compatible sink adapters
• add Ed25519-attested non-secret receipts and staged prepare/commit/abort/status activation
• add durable rollback, rotation, retirement, orphan, expiry, and restart recovery
• add bounded environment/child injection and credential redaction
• close review recovery gaps for ambiguous finalization, exact sink identity, and child cleanup failure
• keep git-subdirectory preparation package-local to secrets, sql, and utils

Validation

• Node 24.18: pnpm --filter @happyvertical/secrets test (108/108)
• pnpm build (32/32), pnpm typecheck (20/20), pnpm lint
• pnpm test:ci-scripts (36/36), pnpm agent:check
• clean exact-SHA git consumer under Work CI registry layeringn- final exact-head review-cycle clean

Coordinates happyvertical/happyvertical.com#240 and its #164 credential provisioning path. No Work-specific endpoints or scopes are included.

{"schema":"hv-agent-run:v1","runtime":"codex","session":"codex-01a0012c-sdk1202-ci7","issue":1202,"policy_revision":"1.0.0","status":"complete","validation":["Node 24 secrets 108/108","CI scripts 36/36","build 32/32","typecheck 20/20","lint","exact git consumer","exact-head review-cycle clean"]}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 906ef52b92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

📦 Version Bump Preview

When this PR is merged into main, packages will receive a minor version bump based on your conventional commits.

What happens on merge?

1. Tests run on the main branch
2. Packages are built
3. Versions are bumped automatically
4. The release commit is pushed back to main
5. Packages are published to public npm
6. Git tags are created