#3734 typed-secrets 4.5: the inline resolutions refuse or mask: placement, task selectors, child references and deferred targets refuse secrets, assert messages mask them, and the deprecated resolvers go

Problem

The table in Section 3.3 lists resolutions that still load a secret inline so that each destination receives the value it received before Phase 2: placement and task selectors, child workflow references, deferred task targets with inputs and globalArgs (resolveRecordExpression, resolveScalarExpression), assert message interpolation, and the deprecated resolveVaultExpressionsInDefinition and resolveVaultExpressionsInData.

Scope (Section 3.3 table, Section 7.1, Phase 4)

• Placement values and task selectors refuse a secret with secret_destination_refused. Child workflow references refuse. Deferred task targets refuse, while deferred records issue into the step's bag.
• Assert message interpolation masks a secret.
• The Phase 2 loads at these seams are removed. The deprecated resolvers are deleted and their callers moved onto the passes of Section 5.
• A new inline caller of resolveDeep, or a new direct evaluateAsync caller outside the passes of Section 5, needs a row in the table: add a fitness rule that pins the set.

Exit

Each refusal happens before any load, with a value-free error naming the destination and the authored location, and the counting vault sees zero loads at a refusing destination.

Depends on typed-secrets 4.1 (swamp-club#3730).