Add per-tenant namespacing to secret resolution

[JSONbored]

Problem: Secret resolution mutates global process environment variables in place today — there's no per-tenant namespacing for a model where one process might need to hold more than one tenant's secrets.

Area: ORB / Security

Proposal: Add per-tenant namespacing to secret resolution rather than a single global mutation.

Deliverables:

• Namespaced secret resolution supporting more than one tenant's secrets in the same process where needed.

[linear-code]

JSO-3581

[JSONbored]

Resolved by architecture, not code — same reasoning as #4885/#4886/#4888. Per-tenant Cloudflare Containers mean one process never holds more than one tenant's secrets in the first place; env-var resolution stays global-to-the-process exactly as self-host already does, since that process only ever serves one tenant. I'd originally flagged this issue in the same Fork-1 batch as those three but missed closing it — doing that now.