A secret reaches a process as a file (ADR 0086)

The broker settings take a _FILE twin like the store connections; the
catalogue engine refuses a secret placeholder in a container's env and a
secret-carrying env-file unless the container says why with
secrets-in-environment, which stays in the catalogue and never reaches the
machine.

internal/catalogue/declaration.go

@@ -442,6 +442,10 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 		// And the machine underneath, which no binding of its own can tell it.
 		thisMachine := machineFacts(r)
 
+		// Which of this module's files carry a secret, for the rule that a container may not read
+		// one of them as its environment without saying so (ADR 0086, issue 041).
+		secretFiles := secretFilesOf(resources)
+
 		for _, unsettled := range resources {
 			resource, err := ApplySettings(unsettled, with.Settings[m.Module])
 			if err != nil {
@@ -451,6 +455,12 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 			for k, v := range resource {
 				copied[k] = v
 			}
+			if err := refuseSecretsInEnvironment(copied, secretFiles, m.Module); err != nil {
+				return nil, err
+			}
+			// Said in the catalogue, not on the machine: the host parses strictly and knows no
+			// such field, and the reason is for a reader of the manifest.
+			delete(copied, SecretsInEnvironment)
 			// **After settings, and that is the whole reason it is here.** A module's file
 			// content is where a setting lands, so a placeholder may only exist once the setting
 			// has been put in — filling secrets first would look at content that is not yet what