Support dynamic secret injection and log masking during TCK execution

### Description
As the core execution engine,
I need to securely accept dynamic secrets and ensure they are masked in all outputs,
so that sensitive tenant data is never leaked in execution traces, reports, or stdout logs.

### Acceptance Criteria

- [ ] **Context Injection:** Extend the engine's `ExecutionContext` (or equivalent configuration model) to accept a dictionary/map of temporary secrets passed.
- [ ] **Secret Masking:** Implement a sanitization/masking utility that automatically replaces the actual secret values with `***MASKED***` before any data is written to execution traces, output files, or terminal logs.
- [ ] **Assertion Safety:** Ensure that if an assertion fails, the error message does not expose the secret value (e.g., comparing a masked string in the output instead of the raw secret).
- [ ] **Documentation:** Add a brief guide or example in the repository demonstrating how the backend should inject these secrets when launching a TCK job.

Start by locating the engine's ExecutionContext or equivalent configuration model and trace how execution data reaches traces, output files, terminal logs, and assertion errors. Define the masking behavior for injected temporary secrets across each output path, then add the requested backend injection guide or example and verify that failed assertions do not reveal raw secret values.

Written by the indexing model from the issue text.