feat: worker dynamic secret/resource resolution for resource association

[pyramation]

Summary

Adds runtime support for dynamic secret and resource resolution in the compute worker, enabling functions to declare required_secrets/required_configs in their definitions and have them validated from the DB at dispatch time.

Core changes:

1. SecretsLoader (packages/module-loader/src/secrets-loader.ts) — new domain loader that queries metaschema_modules_public.config_secrets_module to discover the secrets table, then resolves secrets by name + namespace. TTL-cached, multi-database aware, follows the same pattern as BillingLoader/ComputeModuleLoader.

2. ComputeWorker.validateSecrets() — called in doWork() after function discovery but before dispatch. Checks that declared required_secrets/required_configs exist in the config_secrets_module; logs warnings for missing entries. Does not inject into process.env — actual secret delivery to Knative services is handled by the provisioning pipeline via K8s secrets.

3. FunctionContext extended with optional namespace, buckets, apis fields for future resource association phases. Secrets continue to flow via context.env (populated by Knative env vars, not worker injection).

4. Three stub function handlers for the provisioning pipeline (validate + log only, no DB calls):

   • namespace-provision — validates namespace_name format
   • function-provision — validates function_id, logs service_url and secret count
   • function-sync-resources — validates resource declarations, logs summary

// Resolution flow in ComputeWorker.doWork():
fn = discovery.resolve(taskIdentifier)  // step 2: cached DB lookup
await validateSecrets(fn, dbId)         // NEW: check existence, warn on missing
await doWorkHttp(job, fn, ...)          // step 4: dispatch

Ref: constructive-io/constructive-planning#1062

Link to Devin session: https://app.devin.ai/sessions/815b2f2fc57441b0ae3430add6e90a70
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring