Deploy lane: materialize Key Vault bindings for suites

## What

The resolver validates `keyvault:` bindings and `keyVaultBindings` and reports the secret names it needs under `key_vault.secret_names`, but the deploy lane in `validate.yml` never fetches them. It calls the resolver with no `--secrets` file, so any suite that declares a Key Vault binding fails as env-not-ready even though the deploy identity holds Key Vault Secrets User on the environment's vault.

## Why later

No shipped descriptor uses a Key Vault binding yet, and the fetch needs its own review: read only the declared names with the deploy identity, mask each value, write a mode 600 temporary file, pass it to each suite resolution, and remove it after every suite. ADR-041 records this as not yet wired.

Raised by review on #174.

Read validate.yml and ADR-041 first, then trace the resolver's key_vault.secret_names output and its --secrets input. Done means the deploy identity reads only declared Key Vault names, values are masked, a mode 600 temporary file is passed to each suite resolution, and the file is removed after every suite.

Written by the indexing model from the issue text.