Real secret-injection driver for control-plane's injectSecrets/revokeSecrets via the generalized broker

[JSONbored]

Problem

Split from #7180. Update: this issue's original scoping was wrong. It assumed injecting a hosted tenant's database credentials could just call "the generalized broker's issue/revoke path" — investigation (see #8064) found #7174 only generalized the storage layer (a secret_type discriminator column), not the mint logic (still 100% hardcoded to GitHub tokens) or any revoke mechanism (none exists anywhere in this codebase). Real work is needed on both the broker side and the control-plane side before this can close — split into the two sub-issues below rather than attempted as one PR, given the security sensitivity of secrets custody.

Sub-issues

• Add a tenant-DB-credential secret type + generic revoke path to src/orb/broker.ts #8064 — Add a tenant-DB-credential secret type + generic revoke path to src/orb/broker.ts (blocking)
• Wire control-plane's real injectSecrets/revokeSecrets against the broker (implements #7852) #8066 — Wire control-plane's real injectSecrets/revokeSecrets against it (blocked by Add a tenant-DB-credential secret type + generic revoke path to src/orb/broker.ts #8064)

Area

src/orb/broker.ts, control-plane/src/tenant-provisioning-driver.ts, control-plane/src/provisioning.ts. See each sub-issue for its own precise scope.

Resources

• Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 (parent — one of its five sub-issues; feat(control-plane): provisionTenant()/deprovisionTenant() orchestration behind an injectable driver interface (fake driver only) #7524/Real Postgres/Hyperdrive driver for control-plane's provisionDatabase/deprovisionDatabase #7653/Stand up control-plane's real HTTP transport (POST/GET/DELETE /v1/tenants) matching the already-merged client #7654/Real Cloudflare Containers driver for control-plane's createContainer/destroyContainer/containerExists #7851 already shipped, this is the last)
• Generalize src/orb/broker.ts into a multi-secret-type broker shared by ORB + AMS hosted #7174 (closed — the secret_type discriminator this builds on)
• Add AMS-specific secret type to the generalized broker (src/orb/broker.ts) #7674 (sibling, still open — coordinate secret-type naming/shape with Add a tenant-DB-credential secret type + generic revoke path to src/orb/broker.ts #8064, don't duplicate)

Boundaries

This issue itself does not implement anything directly — see #8064/#8066 for the real deliverables and boundaries.

maintainer-only — secrets custody design touches every tenant's blast radius; no partial/contributor-drafted version merged ahead of full review.

[linear-code]

JSO-5494