Support Secret References in Subscription Recipients

Currently we can reference secrets in service configurations using the `$secret-name` syntax, but it is not available for subscription recipients. This makes it difficult to manage recipient information (like private Slack channels or distribution lists) through K8s secrets.

#### Current Behavior
- **Service Configurations**: Support referencing secrets using `$secret-name` syntax.
Example:
```yaml
service.slack: |
token: $slack-token
```
- **Subscriptions**: Do not support secret references. Recipient information (e.g., Slack channels, email distribution lists) must be hardcoded.
Example:
```yaml
subscriptions: |
recipients:
slack: private-channel-name # Hardcoded
email: team-list@company.com # Hardcoded
```

#### Desired Behavior
- Extend secret reference functionality to subscription recipients.
Example:
```yaml
subscriptions: |
recipients:
slack: $slack-channel
email: $team-email
```

#### Use Cases
- Storing private/sensitive recipient information (e.g., Slack channels) in secrets.
- Managing different recipients per environment using secrets.
- Centralizing recipient management alongside other configurations.

Start by locating the existing `$secret-name` handling for service configurations and the parsing path for subscription recipients. Trace how Slack and email recipient values are loaded, then verify the desired YAML examples with tests or a local configuration run; done means secret-backed recipient values work for both examples without changing direct values.

Written by the indexing model from the issue text.