Add typed environment secret references

docs/internal/overview.md

@@ -31,14 +31,20 @@ module and package documentation boundary. Its implemented public primitives are
   intent, private before/after snapshots, and resolution metadata integration; and
 - post-resolution schema-aware report collection and validator mutation detection in
   `validation.go`, completing the public callback lifecycle after composed input;
+- opaque typed environment references and per-load name resolution in
+  `secret_reference.go`, including credential-free projection/cloning and private
+  validator-state auditing;
+- explicit bounded startup environment bootstrap and safe partial reporting in
+  `secrets.go`;
 - fixed-point tag/predicate/dependency sensitivity classification in `secret.go`; and
 - frozen-snapshot redaction and canonical effective output in `render.go`, with the
   only upstream dumper integration isolated in `internal/yaml/write.go`.
 
 The [configuration contract](../config.md) owns implemented input, schema, decoding,
 loading lifecycle, path imports, composition, profile overlay, version checking,
-recorded resolution, semantic validation, metadata, secret classification, redacted
-effective rendering, and ownership behavior.
+recorded resolution, typed secret references/bootstrap, semantic validation,
+metadata, secret classification, redacted effective rendering, and ownership
+behavior.
 
 The source-extraction inventory records the application foundations assigned to
 future implementation work: