First production capability slot end-to-end: secrets management, built in and default-off

> 🤖 Generated by the Agentic Engineer

Part of #6875. The first production capability delivered end-to-end, chosen to prove the whole path.

## Why secrets management is the right first slot

It is the smallest capability that exercises **every** hard part of #6875 at once, so if the design is
wrong this is where it shows — cheaply, once, instead of expensively across fourteen slots:

- It is **multi-component**: a store plus an operator plus trust distribution, so it forces the slot
dependency model from #6876 to be real rather than theoretical.
- It has **genuine alternatives** an adopter will care about (a self-hosted store versus a managed
cloud one), so the enum-plus-default shape is exercised rather than assumed.
- It is **stateful and security-critical**, so "provision it and walk away" is not good enough — it
surfaces the day-2 questions early.
- It is the capability adopters are **most likely to need to override**, which makes it the honest
first test of #6878 rather than a friendly one.
- KSail today covers only SOPS, which is file encryption — not a secrets *platform*. The gap is real
and the reference platform's answer (External Secrets + OpenBao + trust-manager) is proven in
production.

## Scope

One capability slot for secrets management, with an opinionated default drawn from #6877's verdict,
provisioned from KSail's built-in configuration with **no hand-written GitOps config required**, and
overridable per #6878.

Deliberately **not** in scope: the other capability classes. This child exists to prove the path, and
its value is mostly the design feedback it produces.

## Acceptance criteria

- [ ] The slot is selectable in configuration, with an opinionated default and at least one alternative
plus `None`.
- [ ] Selecting it on a fresh cluster yields a working secrets path — a secret defined in the external
store materialises as a Kubernetes Secret and a workload consumes it. **Observed on a real
cluster, not inferred from rendered manifests.**
- [ ] Deselecting it removes what it installed, without stranding resources.
- [ ] An adopter can override a setting the slot does not expose, via the #6878 path, and the override
survives a reconcile.
- [ ] Shipped **behind a feature flag, default-off, and tested in both states**, per the portfolio
delivery contract.
- [ ] Documentation covers selection, the default's justification, and the override path.

## Dependencies

Needs #6876 (schema and contract) decided. Needs #6877's verdict for this capability. Exercises #6878.

## Size

Large — it is the first of its kind, so it pays the cost of establishing the pattern. Subsequent slots
should be materially cheaper, and if they are not, that is the signal the design needs revisiting.

Start by reading the schema and contract in #6876, the secrets-management verdict in #6877, and the override path in #6878, then inspect KSail's built-in configuration and provisioning entry points. Done means a feature-flagged, default-off slot supports the default, an alternative, and None; works on a real cluster; cleans up on deselection; preserves overrides across reconcile; and includes documentation.

Written by the indexing model from the issue text.