Constrain secret readers with curry arguments

[nishu-builder]

Summary

• require every .caos-secrets reader= line to contain an explicit typed --base
• treat the field value as the same typed argument list accepted after curry; reader= denotes assembly, so there is no curry token on the line
• reuse the existing expression parser and ArgTree assembly, including pinned-tree :@= resolution
• assemble and unwrap readers into the existing partial name-to-OID map without executing the resulting request
• remove the old path-only shorthand and migrate repository fixtures and documentation
• update the TUI missing-secret guidance to print the required typed reader bases
• keep the server-side subset matcher and secret injection model unchanged

This PR is deliberately generic: it does not change llm-step, llm-call, conversation request construction, or Anthropic defaults. The LLM fixtures are changed only to use the required explicit reader base.

Why

Path-only readers constrain worker identity but leave every additional argument unconstrained. Secret owners need to pin local grant policy such as an allowed destination, repository, or environment without creating repository-owned wrapper expressions.

This restores inline reader constraints removed in 91866bd94: content-addressed worker identity belongs in the source tree, while the secret owner's local constraints belong with the per-device secret grant.

Syntax

reader=--base:@=DEEP-DEPS/github-push --repo=github.com/me/project

Each reader= is one independent partial ArgTree. Missing, duplicate, rebound, malformed, untyped, and unsuitable bases fail clearly. Secret values and entropy remain out of ArgTrees; only the existing entropy-derived secret-hash enters them.

Security coverage

• exact pinned constraints grant the secret
• changing a pinned constraint denies it
• copied or forged secret-hash values cannot bypass a mismatch
• extra unpinned arguments still match
• multiple readers retain independent bases and constraints
• path and hash forms resolve with ordinary curry OID identity
• malformed and obsolete reader forms fail closed

Dependency

This PR is one commit on top of current main, which contains #113. It does not alter #113's sub-run conversation design; it only changes reader parsing and migrates reader declarations to the explicit-base grammar.

Validation

• cargo fmt --all -- --check
• cargo test --workspace
• nix build
• fresh salted CAOS_SALT=$(date --iso=s) result/bin/caos-cli run-tool test: 45/45 passed, including secrets and sub-run
• git diff --check