#3732 typed-secrets 4.3: the expression-facing query view registers Secret in DataQueryService

Problem

DataQueryService evaluates predicates and projections in its own synchronous CEL environment that knows nothing of Secret. On the typed path, data.query returns tagged fields as reference text and authorizes nothing. Section 10.3 names this as one of the two gates for turning the typed path on; the other, swamp-club#3635, has shipped.

Scope (Section 6.2)

• Register Secret with the same refusals in the query environment, and wrap tagged attributes before any predicate or projection runs, because wrapping only the returned value is not enough.
• A predicate cannot operate on a secret. A projection may return a Secret or a container of them, returned to the calling expression without cloning. Each Secret is converted or skipped before the coerceBigInts walk, so selecting a tagged attribute does not trip the ownKeys trap.
• Errors propagate: query filtering never turns a refusal or a malformed reference into false, a missing row or null.
• The raw swamp data query command keeps returning stored reference text, and raw content of non-JSON resources and files is unchanged.
• Architecture fitness: no Secret import outside the CEL adapter, the accessor adapter and the query view.

Exit

The query rows of the accessor integration suite pass, refusal propagation is pinned, and swamp data query output is unchanged.

Depends on typed-secrets 4.1 for the typed consumers; independent of 4.2.