Add secrets list and rm to the CLI

[dantheuber]

This branch assembles the listed issues for review.

Issues in this consist

• Add secrets list and secrets rm to the CLI #37 Add secrets list and secrets rm to the CLI

Closes #37

What & why

Completes the write-only millwright secrets command group by adding list and rm, mirroring the existing repo list / repo remove shape. Operators can now enumerate stored secret names and delete individual parameters from the CLI instead of going through SSM directly.

Changes

• secrets list [--scope <scope>] [--all-scopes] — prints secret names only (sorted); values are never fetched or decrypted. --all-scopes walks the whole secrets/ prefix, printing <scope> <name> lines, and doesn't require an origin remote.
• secrets rm <name> [--scope <scope>] — deletes one parameter, reports the removed path, and exits 1 via CommandError when nothing was deleted.
• Shared pre-check (isSecretNameSegment) and scope resolution (defaulting from the cwd origin remote, same as secrets set) factored into helpers in secrets.ts; set keeps its promptSecret dependency while list/rm use the narrower SecretsScopeDeps.
• New secretFromParameterName inverse in millwright-state's ssm-paths.ts, used by list to invert parameter names the same way repo list does. Recursive listing under secrets/acme/ is filtered to the exact scope so acme/api secrets don't leak into a listing of scope acme.
• Docs updated: README secrets section, the "Secrets not resolving" troubleshooting step in docs/operations.md, and the CLI surface note in okf-bundle/interfaces/cli.md.

Review notes

• Worth double-checking the --all-scopes prefix walk and the scope-filtering logic in secretFromParameterName against nested scope names.
• Version bumped to 0.8.0 (minor) — new backward-compatible CLI functionality, no breaking changes.
• Full test suite green: 108 files / 1136 tests passing; typecheck clean across all workspaces.

[cb-jeeves]

Adds secrets list and secrets rm on top of the existing secrets set, with a secretFromParameterName inverse in millwright-state to turn parameter names back into scope + name. The shape matches repo list / repo remove, the listing never asks SSM to decrypt, and rm fails with a useful message when nothing was deleted. This is close to mergeable; three suggestions below, none blocking.

The submit pass ran on claude-opus-5 after its primary model failed.

The correctness pass ran on claude-opus-5 after its primary model failed; maintainability pass ran on claude-opus-5 after its primary model failed; ux-dx pass ran on claude-opus-5 after its primary model failed.

[cb-jeeves]

Responded to review round 1, pushed 64b35f9:

• Addressed --all-scopes silently discarding --scope: the option is now declared with Option.conflicts('scope'), so the combined invocation fails with commander's conflict error. The suggested .conflicts() call is an Option method, not a Command one, so the fix uses addOption. Added a parse test for the rejection.
• Addressed the untested scope filter: added tests storing acme/DEPLOY_KEY and acme/api/NPM_TOKEN, checking that scope: 'acme' returns only DEPLOY_KEY and that --all-scopes lists both under their own scopes.
• Addressed the duplicated row type: SecretsListEntry is now an alias of SecretParameterParts from millwright-state; the CLI export name is unchanged.

npm run typecheck and npm test pass (1139 tests).

[cb-jeeves]

All three findings from round 1 are addressed in 64b35f9: --all-scopes now conflicts with --scope, the nested-scope filter has tests on both sides, and SecretsListEntry aliases SecretParameterParts.

The submit pass ran on claude-opus-5 after its primary model failed.

The correctness pass ran on claude-opus-5 after its primary model failed; maintainability pass ran on claude-opus-5 after its primary model failed; ux-dx pass ran on claude-opus-5 after its primary model failed.