row 166 PR2b: a program's environment secrets resolve at declaration and are held; a spawn resolves nothing

[MattJackson]

Stacked on #864 (and #863). Row 166 PR2b implements the ARCHITECT ruling of 2026-10-13 on stdio member env timing.

• busbar-core-connector::spawn_env::HeldEnv: env secret references resolve at the need's declaration (declare_program / declare_member_programs hold the config-time proof; a kept member re-resolves at an apply). They are held in an ArcSwap, so a spawn loads them without a lock and resolves nothing.
• Refresher: one thread re-resolves every live held environment each SPAWN_ENV_LEASE (60 s), off the request path, keeping each weakly, as P3 FLIP-A2A: the a2a plane served through its door; busbar-a2a deleted (stacked on #778) #787's PerHop does. A reference that stops resolving empties the cell, and every spawn after it is refused.
• Dest::Program and Admission::Spawn carry the held env to the host's io.spawn. SpawnSecretFn takes the proof, and the root installs resolve_linked_string_at_config.
• config-scope gate: allow-list rows for the two declarations and the refresher.
• docs/mcp.md: a rotated secret reaches the first NEW child after the next refresh. Stdio members are new in 1.6.0, so there is no 1.5.5 baseline and no register entry.
• config-schema snapshot: SpawnSecretFn target updated, since it now takes the proof.
• RED a_spawn_resolves_nothing_and_a_rotation_reaches_the_first_child_after_the_refresh:
  • two spawns, one resolution;
  • a rotation reaches no child before the refresh, and does reach the first child after it;
  • a reference gone at a refresh refuses the spawn.
    The member-program cell asserts that its first lease's spawn resolved nothing.

The 60 s lease is a fixed host constant: stdio members have no lease key, and adding one would add config surface.