feat(cycle): secrets & variables reconcile cycle (#11)

[lex00]

Closes #11.

Adds the secrets-variables cycle — reconciles Actions secrets and variables at org + repo scope.

The core invariant: never secret values

• Secrets are reconciled by presence only. warden never reads or writes a secret value. A declared-but-missing secret is reported (apply raises a clear "provision its value out-of-band" error → reported failed entry, never a value write). An undeclared live secret is removed only when ownership-gated. There are no secret "updates" (values aren't visible).
• Variables are not secret, so they're reconciled fully: create (POST), update value (PATCH), delete. A variable with no declared value is presence-only.

New types

• Config: SecretConfig (with an informational, never-written rotationRef) and VariableConfig on both OrgConfig and RepoConfig.
• Diff: LiveSecret/LiveVariable + diffSecrets (presence) / diffVariables (value) → four resource types org-secret, repo-secret, org-variable, repo-variable, added to RESOURCE_TYPE_ORDER.

Notes

• Org-level fetches tolerate 403/404 as "nothing live" (an app without org-secrets permission doesn't error the run).
• Environment-scoped secrets/variables (GitHub's third scope) are a documented follow-up — they need an environment dimension in the key.
• Tests assert the never-values invariant end-to-end: under apply, a missing secret yields a reported failure and zero non-GET calls.

Verification

• npx tsc --noEmit clean
• npm test green (373 tests; +15 in secrets-variables.test.ts)
• Action bundle rebuilt for the CI freshness check

🤖 Generated with Claude Code