feat(notsecrets): add multi-provider secret resolution system

Add a config-driven, strongly-typed secret/env resolution system to
notsecrets with 11 provider backends. The system supports explicit
key bindings with typed SecretRef enums and a priority chain fallback.

Tier 1 providers (implemented): Env, 1Password, dotenvx, SOPS, GSM
Tier 2 providers (stubbed): nuenv, direnv, mise, Bitwarden, Vault, dotenvy

New types: Provider, ProviderConfig, SecretRef, SecretsConfig,
SecretsError, SecretSource, EnumerableSecretSource, SecretResolver

Config lives in notsecrets.toml with typed serde deserialization.
ISP split: EnumerableSecretSource for backends that support bulk
enumeration, SecretSource for single-key lookup only.

Includes conformance test suite, 33 new tests (161 workspace total).
notstrap EnvInjector migration deferred to follow-up.

crates/notsecrets/src/sources/dotenvy.rs

@@ -0,0 +1,35 @@
+use crate::config::Provider;
+use crate::error::SecretsError;
+use crate::ports::SecretSource;
+
+pub struct DotenvySource;
+
+impl SecretSource for DotenvySource {
+    fn name(&self) -> &str {
+        "dotenvy"
+    }
+
+    fn provider(&self) -> Provider {
+        Provider::Dotenvy
+    }
+
+    fn resolve(&self, _key: &str) -> Result<Option<String>, SecretsError> {
+        Ok(None)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn dotenvy_stub_resolve_returns_none() {
+        assert_eq!(DotenvySource.resolve("ANY").unwrap(), None);
+    }
+
+    #[test]
+    fn dotenvy_stub_name_and_provider() {
+        assert_eq!(DotenvySource.name(), "dotenvy");
+        assert_eq!(DotenvySource.provider(), Provider::Dotenvy);
+    }
+}