todo(profile): [94-3] Secret Boundary 实装：禁用 remote secret 读取

[Akane-CN]

Parent

• todo(profile): redesign profile management with ClawPal as SSOT and no secret reads from remote OpenClaw #94

Scope

• 删除/封禁 remote secret discovery / resolve 路径
• 统一 secret ingestion 入口到 ClawPal trusted side

接口

• SecretProvider 仅允许 Local/Trusted
• 远端 secret fetch 返回错误：ERR_REMOTE_SECRET_PULL_BLOCKED

验收标准

• 无 remote secret pull 调用点
• 单测覆盖“尝试远端读取 -> 必须失败”
• 日志可审计被拒绝路径

依赖

• [94-1] todo(profile): [94-1] 设计冻结：SSOT + 威胁模型 + 同步协议 #98
• [94-2] todo(profile): [94-2] 数据模型重构：ClawPal 侧 SSOT schema #99