PodmanService gains secret_env (env name + secret name under
<kv>/<prefix>/<deployment>/); the agent resolves references at apply
time through harmony_secret's OpenbaoSecretStore, reusing the NATS
path's ZitadelJwtBearer — one machine identity for both consumers.
Resolution failure surfaces as Phase::Failed naming the denied fetch.
- OpenbaoSecretStore::with_zitadel_bearer: no token-file cache; login
is lazy and get_raw retries once through refresh_auth on permission
denied (batch tokens expire without renewal; re-login IS the sync)
- agent [openbao] config section (url + secret_prefix; mounts/role
default to the staging shape)
- FleetDeviceSetupScore renders the [openbao] block when configured
- resolution binds at apply, never on the periodic tick, keeping the
secret store off the 30s hot path (fleet-scale login load is the
ADR-025 constraint)
Jean-Gabriel Gill-Couture
23e4709f1f