deploy_component: resolve registry auth from the secrets store (rollback/redeploy/clone re-execution)

Follow-up to #1158 (transient registryAuth) once the secrets store (#715) lands; phase 4 of the secrets-management plan.

- `registryAuth: [{ registry, scope }]` with no token → resolve the CURRENT token from `hdb_secret` (reserved metadata `type: registry-token`, keyed by registry host + optional scope). Reference-not-embed: a rollback months later uses today's valid token, not an embedded revoked one.
- Replicated deploys resolve locally on each peer from its own replicated ciphertext — removes the need for externally provisioned npmrc on peers.
- Execution stays plaintext-free on disk: transient .npmrc uses npm's ${VAR} interpolation, decrypted token passes only through the npm child's env.
- The transient inline-token path from #1158 remains for one-shot/CI use (strip-before-replicate unchanged).

🤖 Drafted by Claude (Fable 5) on Kris's behalf.