feat(notsecrets): add multi-provider secret resolution system

Add a config-driven, strongly-typed secret/env resolution system to
notsecrets with 11 provider backends. The system supports explicit
key bindings with typed SecretRef enums and a priority chain fallback.

Tier 1 providers (implemented): Env, 1Password, dotenvx, SOPS, GSM
Tier 2 providers (stubbed): nuenv, direnv, mise, Bitwarden, Vault, dotenvy

New types: Provider, ProviderConfig, SecretRef, SecretsConfig,
SecretsError, SecretSource, EnumerableSecretSource, SecretResolver

Config lives in notsecrets.toml with typed serde deserialization.
ISP split: EnumerableSecretSource for backends that support bulk
enumeration, SecretSource for single-key lookup only.

Includes conformance test suite, 33 new tests (161 workspace total).
notstrap EnvInjector migration deferred to follow-up.

.ctx/HANDOFF.md

@@ -1,17 +1,14 @@
-# Handoff — notfiles (2026-04-17)
+# Handoff — notfiles (2026-06-06)
 
-**Branch:** main | **Build:** clean | **Tests:** passing
-Added notnet crate with YubikeySource and threaded Tailscale into notstrap; Tailscale
-integration design spec written.
+**Branch:** main | **Build:** unknown | **Tests:** unknown
 
 ## Items
 
 | ID | P | Status | Title |
 |---|---|---|---|
-| - | - | - | No open local handoff items |
 
 ## Log
 
-- 2026-04-17: Added notnet crate with YubikeySource and threaded Tailscale into notstrap; design spec complete [c7c074d, dfdd9ca]
-- 2026-04-15: Hardened bootstrap and hook-state failure handling, made notfiles FileStore usage real, and fixed copy-drift safety coverage [67f20ee]
+- 2026-04-17: Added notnet crate with YubikeySource and threaded Tailscale into notstrap; design spec complete
+- 2026-04-15: Hardened bootstrap and hook-state failure handling, made notfiles FileStore usage real, and fixed copy-drift safety coverage
 - 2026-04-15: Pruned completed items from handoff; GitHub issues plus doob are now the source of truth for active work