Bind engine secret handling to facade types

docs/roadmap/implementation.md

@@ -276,6 +276,30 @@ tests pass; binding instances cannot affect each other. Run
 `go test ./internal/engine -run 'Secret|Schema|Decode|Clone|Projection|Validation|Callback'`,
 `go test -race ./internal/engine`, and the everyday check.
 
+### Completion
+
+Status: complete (2026-09-12).
+
+`internal/engine` now receives a per-operation `SecretBinding` at schema and
+load construction. Its exact `reflect.Type`, `Read`, and `Make` functions carry
+the facade-owned `SecretState` through decoding, projection, unresolved and
+validated cloning, dynamic-value rejection, secret lookup, resolution helpers,
+and validator mutation auditing. The binding is retained by each schema only;
+there is no package-global registration or engine-owned replacement secret.
+
+Removed the candidate's production `Secret` and `SecretEnv` declarations.
+`secret_binding_test.go` provides a local test secret type, fresh binding for
+every test load, and exact-type/isolation coverage using a second local secret
+type. Existing secret tests continue to cover defaults, pointers and containers,
+resolution-selected names, lookup-once behavior, borrowed callback values,
+redaction, and validator replacement without credential disclosure. The root
+implementation remains unchanged for this migration handoff.
+
+Linux validation with Go 1.26.7 passed the focused secret/schema/decode/clone/
+projection/validation/callback suite, `go test -race ./internal/engine`, and
+`./scripts/check.sh`. There were no deviations. The next handoff creates the
+temporary facade's root-owned value, source, diagnostic, and secret wrappers.
+
 ## Stage 4 — Build candidate value, source, and diagnostic wrappers
 
 Status: not started.