feat: Add Infisical adapter

Summary

Add Infisical as a secret source adapter for project-aware secrets.

Context

The SourceAdapter interface exists in internal/adapters/adapter.go. Vercel is implemented as reference.

Implementation

Files to create

• internal/adapters/infisical/infisical.go
• internal/adapters/infisical/infisical_test.go

Spec

type InfisicalAdapter struct {
    binary string // path to infisical CLI, default "infisical"
}

func New() *InfisicalAdapter
func (i *InfisicalAdapter) Pull(project, scope string) (map[string]string, error)
func (i *InfisicalAdapter) Name() string // returns "infisical"

CLI command

infisical export --projectId <project> --env <scope> --format dotenv

Register in cmd/secrets/adapter.go

case "infisical":
    return infisical.New(), nil

Test pattern

Follow internal/adapters/vercel/vercel_test.go - mock the CLI, test env parsing.

.secrets.json example

{
  "source": "infisical",
  "project": "proj_abc123",
  "scope": "production",
  "ttl": "1h"
}

Acceptance

• secrets env works with "source": "infisical"
• Tests pass without requiring actual Infisical CLI
• Error message when infisical CLI not installed

Start with internal/adapters/adapter.go and the reference implementation in internal/adapters/vercel, then inspect cmd/secrets/adapter.go for registration. Add the specified Infisical files, follow the Vercel test pattern to mock the CLI and parse its environment output, and verify secrets env works without Infisical installed and reports that missing dependency.