Agent-level Secret references injected as run env (CRD-only, no UI)

An Agent may reference Secrets/ConfigMaps (`envFrom`-style) that the controller injects into run pods as env vars — the documented pattern for "my agent needs an API token" without putting the value in a param or a prompt. Scope fence for dev preview: CRD-level only. No UI surface, no Hub-credential integration, and secrets are never rendered into prompts.

Done when:
- An Agent-referenced Secret appears as env on the run pod in E2E, and the pattern is documented.

Depends on: none.

Start by tracing the Agent CRD reference through the controller path that creates run pods, then inspect the existing E2E coverage and documentation for agent configuration. Done means an Agent-referenced Secret or ConfigMap is present as environment variables on the run pod in E2E, with the CRD-only pattern documented and no UI or prompt rendering involved.

Written by the indexing model from the issue text.