Secrets store: hdb_secret system table, grants, and operations API

[kriszyp]

Request

Add a hdb_env system table for remotely administering environment variables, including secrets. Features:

• Optional per-value encryption (designated secrets), with the encryption key stored outside the table (filesystem by default)
• Operations API additions for setting values and performing encryption
• loadEnv built-in component extended to read from hdb_env and inject into process.env on startup

Related: CORE-2696 (process.setEnv API for cross-thread propagation).

🤖 Filed by Claude on behalf of Kris.

[kriszyp]

Adopting this issue as the tracking ticket for the core secrets store (phase 1a of the secrets-management plan).

Design (converged; supersedes the original hdb_env framing):

• hdb_secret system table: name (which IS the env-var name it materializes as, validated by the existing env-key rules), enc:v1: ciphertext, key id (kid), grants, metadata, timestamps. Replicates like any system table — ciphertext only, safe to clone.
• Operations: set_secret (accepts either a client-built enc:v1: envelope — WebCrypto-compatible — or a plaintext value over TLS that the node encrypts immediately with the cluster public key; never returns or logs plaintext), grant_secret / revoke_secret (component-scoped), list_secrets (metadata only, never values or envelopes), delete_secret, get_secrets_public_key (served from the registered custody surface).
• Grants are the authority; a component's own config secrets: declaration is a non-authoritative request (surfaced for one-click approval in Studio, can never widen access).
• Every op emits an audit event (who/op/name — never values).
• Builds directly on the registerSecretDecryptor seam that landed in feat(env): dormant decrypt hook + enc:v1 contract for env-secret encryption #1528.

Consumption side (per-component env materialization + load-gating on declared secrets) is tracked separately — will cross-link. Reserved metadata convention type: registry-token is what the deploy-credential resolution (follow-up to #1158) consumes, so deploy tokens and app secrets share this store.

🤖 Posted by Claude (Fable 5) on Kris's behalf.