feat: Fir-429 Broker dispatch, accept loop, and secret_providers config

[nappa85]

Why

The pieces from PR08/09 (dictionary, broker transport, gateway, intercept,
shim client) are all standalone modules; this PR is where firma-run's
config layer learns to parse a secret_providers table and where the
broker gets an actual accept/serve loop turning shim connections into real
subprocess launches. Sandbox mounting/injection is deliberately deferred to
PR11 so this stays reviewable as "config + dispatch logic" without sandbox
concerns mixed in.

What Changed

• crates/firma-run/src/config.rs:
  • ResolvedProfile.secret_providers: BTreeMap<String, IntegrationSpec> —
    CLI vaults keyed by binary basename, HTTP vaults keyed by
    provider_id; merged across [run.defaults] and the active profile,
    later entries winning (profile overrides defaults, custom overrides
    built-in). Presence in this map is itself the authorization to
    intercept — no separate Cedar check.
  • DEFAULT_SIDECAR_ENDPOINT: now unix:///tmp/sidecar.sock on Unix
    (was tcp://127.0.0.1:8080 unconditionally) — cfg-gated per
    AGENTS.md's Unix/Windows platform-support rule.
  • SecretMatcherConfig — TOML-friendly mirror of firma_core::SecretMatcher
    with an explicit type tag.
  • SecretProviderSpec (Cli/Http, explicitly tagged rather than
    untagged, so a CLI-only field like name can never leak onto an HTTP
    entry) and SecretProviderPatch for merging.
  • resolve_secret_providers: resolves the merged table into
    IntegrationSpec values, looking up built-ins by name and validating
    custom matcher specs.
• crates/firma-run/src/secret/accept.rs (new): the broker's accept loop
  — accepts shim connections from BrokerListener and serves each
  synchronously via serve::serve_request. A binary only reaches this
  loop because it matched a configured secret_providers entry, so no
  separate authorization decision happens here.
• crates/firma-run/src/secret/serve.rs (new): per-request dispatch —
  turns one shim request into an actual vault CLI subprocess execution
  plus the intercept transform (PR09), applying the integration spec's
  credential env vars and extractor.
• crates/firma-run/src/{routing.rs, runtime.rs, sidecar/config.rs, sidecar/supervisor.rs}: thread secret_gateway_addr and
  http_secret_providers through AutostartFlags/SynthesizeRequest/
  SpawnRequest so the autostarted Sidecar receives the mirrored HTTP
  vault config and gateway address (consumed by PR07's handler).
• crates/firma-run/tests/integration/sidecar_autostart_*.rs,
  sidecar_config_merge.rs: updated for the new fields threaded above.

Risks / Notes

• accept/serve run subprocess execution with forwarded credential env
  vars outside the sandbox — this is the actual trust boundary of the
  whole CLI-vault design; worth close review even though it's "just
  dispatch."
• DEFAULT_SIDECAR_ENDPOINT's platform split follows the repo's Unix/
  Windows-only support rule (no fallback path for other targets).

AI Assistance

Generated with AI (Claude Code); human-reviewed for correctness and scope.