Run Configuration view: secrets via SecretStorage, passed as environment variables #13

Secret handling for local runs: values stored in VS Code's SecretStorage (OS keychain-backed) and injected as environment variables rather than command-line arguments.

Implemented on feature/views-and-run-config (#2) — src/runConfig.ts.

Design, and why it's shaped this way

Three deliberate choices, all worth preserving:

1. Values never reach the webview. Only secret names are posted; the UI renders ••••••••. A compromised or buggy webview can't read them back.
2. Environment variables, not CLI args. Secrets passed as --key value would land in shell history and be visible in the process list to any local process. buildEnv() resolves them into the terminal's environment instead.
3. SecretStorage, not settings or workspaceState. Backed by the OS keychain, so values never sit in plaintext in the workspace or in a synced settings file. Only the names go in workspaceState, so the list survives a reload.

Known wart

Terminal environment is fixed at creation, so a run with secrets disposes and recreates the Fallout terminal to apply current values. That discards scrollback. Deliberate and commented, but worth revisiting — a run without secrets reuses the existing terminal, so this only bites when secrets are configured.

Labelled security because the note above is the release note worth reading.

Depends on #9, and shares the webview with #12.

Acceptance

• Secret values never appear in webview state, logs, or the rendered DOM
• Values resolve into the run's environment, not its arguments
• Removing a secret clears it from SecretStorage, not just the name list