Env Binding with fake provider and env bundle

[BramVR]

Parent

#70

What to build

Add the first Env Binding vertical slice using deterministic fake provider data. Project-declared logical env requirements should resolve through private bindings into an agent-scoped env bundle, with status recorded in the Agent Run Contract and no raw values in output, state, or metadata.

Acceptance criteria

• Env Binding maps logical env requirements to provider-specific secret references outside repo-local Project Policy.
• Fake provider adapter can materialize an agent-scoped env bundle in tests.
• Scope intersection denies unallowed requirements with actionable diagnostics.
• Agent Run Contract records env requirements, allowed scopes, materialization status, and bundle presence/path without values.
• Secret leak checks cover command output, contract bytes, stored metadata, and e2e report data.

Blocked by

• Agent Run Contract v1 baseline #73