KNELSecretsManager (ARCHIVED — moved to KNEL/secrets)

This body of work moved to KNEL/secrets per the 2026-09-03 repo split (#769); content ported as (secret-scanned clean).

This repo is historical. New secrets-management work happens in KNEL/secrets (#770).