Add safe secret lifecycle and runtime service bindings

[miki3421]

Summary

• add secret inspection, generation, atomic binding/unbinding, and authentication setup tools without exposing secret values
• make existing action tools report protocol-level failures and treat compatible repeated operations as successful checks
• validate every action endpoint through one shared schema and parser; reject underscores, spaces, and nested paths with a flat hyphenated suggestion
• reject orchestration variables such as OPS_APIHOST as application secrets, while providing a safe migration path for legacy bindings
• install the Redis Python dependency, return JSON-safe decoded values, and preserve idempotency
• document bucket-scoped S3 behavior: never use list_buckets; verify read/write with put_object, get_object plus content comparison, and delete_object

Why

Agents need deterministic OpenServerless primitives for action naming, authentication, and service wiring. Previously guidance could contradict the platform grammar, actions could be attempted with invalid underscore names, secrets could be partially bound, missing configuration could look successful, Redis could be assumed preinstalled, and S3 account-level bucket listing could be mistaken for an application health check.

The root cause was that these lifecycle and runtime contracts were implicit or enforced only after a mutation tool had already been called. This change moves them into MCP input schemas, shared parsers, generated wrappers, idempotent helpers, and explicit tool results so callers can recover without inventing parameters or leaking values.

Impact

Applications receive an actionable naming error before mutation (for example, v1/employees_photo suggests v1/employees-photo), can configure one shared authentication secret atomically, repair obsolete generated bindings, receive JSON-safe Redis values, and use S3 credentials according to their actual bucket scope. Existing compatible action creation remains a successful no-op.

Validation

• npm test — 12 tests passed
• npm run typecheck
• local package created with npm pack and installed successfully in the Trustable Linux development VM