#3509 typed-secrets 0.1: land the typed-secrets plan as a design enabler doc

Outcome

The typed-secrets implementation plan lives at design/enablers/typed-secrets.md, indexed from design/README.md, so every follow-up issue in the typed-secrets series can cite a stable section number (for example 'Section 8.3' or 'Phase 0') instead of an untracked file.

Why this is first

The plan is currently an untracked file at the repo root. The series is about 55 issues across Phases 0 to 8, and Phase 0 guard work and the Phase 1 CEL feasibility spike start in parallel. Both need the plan committed so their triage, adversarial review and PRs can reference it, and so edits to the plan go through review like any other design change.

Scope

• Add design/enablers/typed-secrets.md with the standard enabler frontmatter: audience maintainer; enables behaviors, workflows, vaults, serve; last-verified 2026-10-15 at dd094735.
• Keep the document's existing structure: Outcome, sections 1 to 13, and the Phase 0 to 8 delivery gates. No content changes beyond what deno fmt requires.
• Add a row to the Enablers table in design/README.md with a note that this is the engine 2 plan and that expressions.md still describes engine 1.
• Run deno fmt on both files.

Out of scope

• Any code, test, or probe harness. The probe harness is typed-secrets 1.1.
• Changes to design/enablers/expressions.md, vaults, or remote-execution. The plan updates those docs with the slice that exposes each behavior (Phase 5).
• Filing the remaining issues in the series. That happens after this lands.

Acceptance

• The file renders on GitHub with its tables and code blocks intact.
• design/README.md links to it and the fitness tests over design/ still pass.
• verify-build, verify-reviews and verify-skills pass at the reviewed commit.

References

• Plan source: typed-secrets-plan.md at the repo root (untracked today).
• Reviewed against swamp dd09473593ea55df83500d798ba096b34c94d6c1 and @marcbachmann/cel-js 7.6.1.