Declarative secret retrieval for CI/CD — fetch from OpenBao, Phase, Vaultwarden, or env by name. No secrets embedded. Part of schmutz-plugins.
