feat(notstrap): migrate to notsecrets age-native API, remove sops shell-out

Replace AgeKeySource/resolve_age_key/install_age_key with IdentitySource/resolve_identities.
Update integration tests to use a valid age bech32 key fixture.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/integration/tests/bootstrap.rs

@@ -19,7 +19,11 @@ fn make_test_env() -> TestEnv {
 
     // age key file (content doesn't matter — FileSource reads it verbatim)
     let key_file = d.join("age.key");
-    fs::write(&key_file, "AGE-SECRET-KEY-1TESTKEY\n").unwrap();
+    fs::write(
+        &key_file,
+        "AGE-SECRET-KEY-1X3QKFQ4MZQM7LTJ3AX0N3EM63RGRV4J6N5ZDWPVKCEUCZKJWJSUSU6GYN6\n",
+    )
+    .unwrap();
 
     // notfiles.toml — one package "shell" targeting home tempdir
     fs::write(