Analyze a feature to provide per-org secrets/env vars to devcontainers on any host #125

Context

Devcontainers consume per-org secrets through remoteEnv with ${localEnv:...}
(GH_TOKEN_FOR_<ORG>, GRAPHITE_*, BITWARDEN_*, TURSO_*, API keys). Today each host has to
define them in its own shell profile, which has several drawbacks:

• they only exist in interactive shells (~/.bashrc): services, non-interactive shells and
  the devcontainer CLI run by a service do not see them
• every host needs the same variables, with the same names (a rename such as
  LEVRIER_PROJECT → LEVRIER_TECH silently leaves a devcontainer with an empty token)
• a profile that exports them is world-readable by default (644)
• dotfiles-sync solves part of it with bind mounts, but a missing source file stops the
  container from starting
• containerEnv would bake them into docker run arguments and docker inspect

Goal

Analyze, then if it makes sense build, a way to provide per-org secrets to a devcontainer:

• from one source of truth, usable from any host (dev host, laptop, Codespaces)
• without bind mounts of host files
• not visible in docker inspect / process arguments / logs
• with a rotated secret picked up on reconnect, not on rebuild
• failing loudly (not with an empty value) when a required secret is missing

Options to evaluate

1. Host-side file + wrapper: ~/.config/<tool>/secrets.env (mode 600) loaded before
   devcontainer up. Simple, per host, what is used today.
2. Bitwarden Secrets Manager (the bitwarden-secrets-manager feature already exists): one
   machine token per org, secrets fetched at container start/attach into remoteEnv. One source
   of truth, nothing to copy between hosts.
3. Docker/Compose secrets or a tmpfs mount populated at start.
4. OS keyring on the host, exposed through a small helper.

Acceptance

• A short comparison (security, multi-host, Codespaces, failure modes) and a decision.
• If a feature is warranted: a devcontainer-feature.json + install.sh + README + test, following
  the repo's feature checklist.