feat: reachability and consumer profiles (SAND-WP-0011)

Add reachability enrichment (tunnel metadata, ops-bridge pointer),
secret_refs boundary resolution, profile.agent-dev and profile.build,
CLI reachability show, API endpoint, consumer smoke scripts, and tests.

src/sandboxer/secrets/__init__.py

@@ -0,0 +1,5 @@
+"""Setup secret resolution at provision boundary."""
+
+from sandboxer.secrets.resolver import resolve_setup_secrets
+
+__all__ = ["resolve_setup_secrets"]

src/sandboxer/secrets/resolver.py

@@ -0,0 +1,41 @@
+"""Resolve profile.setup.secret_refs from operator-injected env (BYOK boundary)."""
+
+from __future__ import annotations
+
+import os
+
+from sandboxer.models import Profile
+
+
+def _secret_env_name(ref: str) -> str:
+    normalized = ref.upper().replace("-", "_").replace(".", "_")
+    return f"SANDBOXER_SECRET_{normalized}"
+
+
+def resolve_secret_ref(ref: str) -> str | None:
+    """Resolve a single secret ref from env. OpenBao injection is operator-owned."""
+    return os.environ.get(_secret_env_name(ref))
+
+
+def resolve_setup_secrets(profile: Profile) -> dict[str, str]:
+    """Resolve all profile secret_refs or raise if any are missing."""
+    refs = profile.setup.secret_refs
+    if not refs:
+        return {}
+
+    resolved: dict[str, str] = {}
+    missing: list[str] = []
+    for ref in refs:
+        value = resolve_secret_ref(ref)
+        if value:
+            resolved[ref] = value
+        else:
+            missing.append(ref)
+
+    if missing:
+        env_hints = ", ".join(_secret_env_name(r) for r in missing)
+        raise ValueError(
+            f"Unresolved secret_refs for {profile.id}: {missing}. "
+            f"Set env ({env_hints}) or use warden route find for OpenBao path."
+        )
+    return resolved