Add --arg-secret to pipeline-runs submit for secret-backed inputs

[arseniy-pplx]

Summary

Adds a --arg-secret INPUT=SECRET_NAME option to sdk pipeline-runs submit so a pipeline input can be bound to a Tangle secret instead of a plain value. Each reference encodes the standard dynamic-data payload under the input in root_task.arguments:

{"dynamicData": {"secret": {"name": "SECRET_NAME"}}}

The flag is repeatable, and a matching arg_secrets mapping is supported in the submit config file so secret bindings can be expressed the same way as the existing args mapping.

Context

Pipelines frequently need credentials (API keys, DB passwords) that should be resolved from stored secrets rather than passed as literals on the command line or checked into config. Today submit only accepts plain values via --arg, --args-json, and config args. This change lets callers reference a secret by name; the backend resolves it at run time via the existing dynamic-data secret contract. No backend or secret-storage behavior changes — this only teaches the CLI to emit the reference payload the backend already understands.

Behavior details:

• Validation before I/O. Inputs and secret names must be non-empty after trimming; malformed entries, duplicate inputs, and unsupported config shapes are rejected before any pipeline file is read or any network call is made.
• Deterministic conflict handling. An input supplied both as a plain value (--arg / --args-json / config args) and as a secret reference (--arg-secret / config arg_secrets) is rejected with an actionable error rather than silently overwritten.
• Precedence. CLI --arg-secret overrides config arg_secrets, matching the existing CLI-over-config convention.
• Unchanged paths. --arg, --args-json, config args, hydration/trust, dry-run, and submit-recovery semantics are untouched. The secret payload passes through payload sanitization unchanged.

A secret input must be a declared pipeline input, identical to --arg.

Testing

• uv run pytest tests/test_pipeline_runs_cli.py
• new tests cover the exact dynamic-data payload shape, single and multiple secret references, trimming, malformed/duplicate rejection, config mapping parsing and type validation, value-vs-secret conflict rejection, CLI-over-config precedence, dry-run, and that validation errors short-circuit before any file read or network call; payload-contract tests pin the dynamicData.secret.name shape against an in-memory fake client
• uvx ruff check on the touched files
• uv lock --check
• git diff --check
• uv run tangle sdk pipeline-runs submit --help shows --arg-secret