#3735 typed-secrets 4.6: turn the typed path on for every entry point, remove the internal option, and delete the regular-expression rewrite, the value search and the plaintext resolution of tagged fields

Problem

Phases 3 and 4 are built behind an internal option that only tests set. The release that ends Phase 4 turns the path on for every entry point and removes the option (Section 10.3). Both gates that section names have shipped (swamp-club#3635 and swamp-club#3636); the query view of typed-secrets 4.3 is the remaining one.

Scope

• Every entry point typed. The engine option, the registry flag and the injectable sensitive-values factories on ModelEvaluateDeps, createModelValidateDeps and ModelMethodRunDeps go. The fitness rule that pins the two forwarding sites becomes a rule that no untyped evaluator is built in production.
• Delete the regular-expression rewrite of vault.get, the value search in toPersistedForm, and the expression-facing plaintext resolution of tagged fields. extractSensitiveFieldValues stops registering plaintext from data reads, since every such value is now a sentinel whose load registers it.
• The typed-path review notes from swamp-club#3628 reach users here, so they land here: report indirect vault use from the Secret usage validation rather than only through check delivery, so validate with a method predicts the run when no check applies; build the vault evaluation scope only when an expression needs it, so an env-only expression never loads a vault configuration; narrow validate's degrade predicate to missing bindings (an input with no default, an unset variable); report one delivery failure per definition instead of the same error once per check; tighten the indirect-vault and Secret usage wording and give JSON consumers separate code and location fields; correct the two stale design passages (Section 4.5 item 3 says ints are delivered as bigints, and the Containers item in Section 4.3 is indented under item 4).
• Characterization corpus with an expected result for every row of Section 10.1. The release notes carry that table.
• Companion issue in swamp-uat: compiled-binary journeys and prohibited-sink scans over every canary class, including the configured datastore and temporary execution locations, not only the local .swamp directory.

Exit (the Phase 4 exit)

Every Phase 4 entry in the inventory stays clean for live, resumed, child, cross-namespace, set-read and projected data. A step that a guard skips makes no vault read. Resume loads current values and reruns no completed step. Non-secret behavior is unchanged.

Depends on typed-secrets 4.1 through 4.5.