refactor(notstrap): replace EnvInjector with SecretResolver

Remove the EnvInjector closure and replace with a secrets_config path
that loads notsecrets.toml and uses SecretResolver for env injection.
Existing parse_env_line validation (blocked keys, null bytes) is
preserved in the injection loop.

tests/integration/tests/bootstrap.rs

@@ -71,7 +71,7 @@ fn make_opts(env: &TestEnv, force: bool) -> BootstrapOptions {
         dotfiles: Some(env.dotfiles.path().to_path_buf()),
         tailscale: Some(None), // skip Tailscale in tests
         check_prereqs: None,
-        env_injector: None,
+        secrets_config: None,
     }
 }
 
@@ -219,7 +219,7 @@ fn test_bootstrap_fails_fast_on_bad_key() {
         dotfiles: Some(d.to_path_buf()),
         tailscale: Some(None), // skip Tailscale in tests
         check_prereqs: None,
-        env_injector: None,
+        secrets_config: None,
     };
 
     let report = run(opts).expect("run() should return Ok even when a step fails");