Persist and resolve dAuth job secrets

[aledefra]

Summary

• redact approved mandatory Deeploy secret paths before create, update, and scale-up dispatches; persist the complete per-job bundle in DAUTH_JOB_SECRETS
• stage the redacted R1FS pipeline CID and its secret bundle transactionally before worker dispatch; commit on success and conditionally roll back on reported failure, timeout, or synchronous error
• bind bundles to the exact pipeline CID, fail closed on incomplete or mixed generations, and migrate eligible legacy unbound bundles from the current placeholder paths only
• resolve dAuth placeholders in the worker runtime only, keeping NetConfig, R1FS, and persisted configuration redacted
• use R1FS metadata as the scale-up configuration authority; replicate secret bundles only to dAuth registry oracles while pipeline metadata also reaches normal peers
• sanitize Deeploy request responses and platform-generated secret-bearing command/environment logs

Dependencies

• Requires Add signed dAuth job secret client ratio1_sdk#179 and Resolve dAuth secrets at worker runtime naeural_core#216.
• Core 7.7.318 must be published before edge Docker images can build with the runtime resolver.

Verification

• modern Deeploy discovery: 215 passed
• focused dAuth/staging/update/logging suite: 76 passed
• final dAuth/routing/logging subset: 18 passed
• git diff --check origin/develop...HEAD

Full container-app discovery still has three documented local-environment failures unrelated to this change: missing nested Core diskapi.py, macOS /tmp canonicalization, and a root-ownership path assertion. The changed platform-log test passes.

Notion: https://app.notion.com/p/38bd59ab6657807cb291cafcd16b1954