Local runs without a secrets.toml crash on st.secrets access (feedback widget)

[mrwadams]

Automated by agent-loop — pi worked this issue on a fresh clone of mrwadams/attackgen; changes were gated outside the agent on agent-1.

Closes #70

How to test

git fetch origin && git checkout agent/issue-70
python3 -m venv .venv && . .venv/bin/activate
pip install -r requirements.txt
streamlit run "00_👋_Welcome.py"

Then open the printed local URL.

Confirm each acceptance criterion:

• With no secrets.toml present anywhere, Welcome and every scenario page render without a StreamlitSecretNotFoundError
• When LANGCHAIN_API_KEY is absent, the feedback widget still renders and no LangSmith call is attempted
• When LANGCHAIN_API_KEY is present in secrets, existing LangSmith feedback behaviour is unchanged
• Every st.secrets access in core/feedback.py is guarded (three access sites today)
• A regression test exercises the no-secrets-file path — i.e. secret resolution raising StreamlitSecretNotFoundError, not merely a mocked "key absent" membership (the existing tests/test_scenario_page.py mock hides this failure mode)

Gates (non-authoritative)

• ✅ files_non_empty — 3 non-empty file(s) changed
• ✅ containment — diff stays within the allowed lane
• ✅ verify — pytest: 243 passed, no failures (browser/e2e excluded)

Draft. Browser/e2e tests were NOT run in-gate — run them and review before merging. Nothing here is auto-merged.