Resolve and deliver tong sidecar secrets through host provider CLIs

[CrypticSwarm]

Summary

Sidecar (tong) definitions reference secrets as ${secret:<provider>:<ref>}.
This adds host-side resolution of those references and a leak-resistant path for
delivering the resolved values into a sidecar.

Secrets are resolved on the host by shelling out to a provider CLI declared once
in the user layer (~/.swarmforge/secret-providers.yaml), e.g.
op: ["op", "read", "{ref}"]. This is the docker-credential-helper pattern, so
Swarmforge knows nothing about any individual secret manager and 1Password, pass,
AWS, Doppler, etc. work without bespoke support. Interactive unlocks (op signin,
biometrics) work because the launcher runs in the user's terminal.

Resolved secrets reach a sidecar through an in-memory tmpfs file plus a
<NAME>_FILE env pointer, never a docker -e env var — anything holding the
docker socket could otherwise read an env value back via docker inspect.

These are host-side helpers exercised only when a definition carries a secret
reference; a launch for a repo with no sidecar definitions is unchanged.

Changes

• Add pure helpers in scripts/tongs.py:
  • load_secret_providers parses the user-layer provider table, returning {}
    for a missing file and raising on a malformed one so a typo surfaces at load
    time; secret_provider_command substitutes the literal {ref} token in
    every argv element.
  • partition_secret_env, secret_delivery_plan, and plan_tong_secrets route
    secret-bearing env to tmpfs files with <NAME>_FILE pointers while leaving
    plain env as -e. The resolved value only ever appears in the file plan,
    never in the -e env. An env name that would escape the tmpfs dir as a path
    component is refused, and a file pointer that collides with a declared env
    var keeps the declared value with a warning.
• Add make_secret_resolver in scripts/run_anvil.py: the impure resolver
  closure that shells out to the provider CLI and returns the secret, raising a
  clear error — naming the provider/reference, never the secret — on an unknown
  provider, an unrunnable CLI, or a non-zero exit. A single trailing newline is
  stripped; other whitespace is preserved.
• Extend scripts/test_tongs.py and scripts/test_run_anvil.py with coverage
  for provider-table loading and validation, {ref} substitution, the exec
  resolver (success, newline trimming, unknown provider, non-zero exit,
  unrunnable CLI), the secret-never-in-env invariant end to end, the
  traversal-name rejection, and the pointer-collision warning. The existing
  passthrough-invariant tests still pass.