Add Notarius configuration profile support

internal/config/load_validate_test.go

@@ -103,6 +103,7 @@ storage:
 notarius:
   enabled: false
   llm_api_key: NARRATIO_TEST_NOTARIUS_KEY
+  config_profile: ""
 `
 	pipelinePath, _ := writeConfigFiles(t, pipelineYAML, testSessionBaseYAML)
 
@@ -140,6 +141,24 @@ notarius:
 			}
 		}
 	}
+	if !strings.Contains(string(firstYAML), "config_profile: \"\"\n") {
+		t.Fatalf("effective YAML omitted explicit empty Notarius config profile: %q", firstYAML)
+	}
+	var roundTrip struct {
+		Notarius *struct {
+			LLMAPIKey     *string `yaml:"llm_api_key"`
+			ConfigProfile *string `yaml:"config_profile"`
+		} `yaml:"notarius"`
+	}
+	if err := yaml.Unmarshal(firstYAML, &roundTrip); err != nil {
+		t.Fatalf("round-trip effective YAML: %v", err)
+	}
+	if roundTrip.Notarius == nil || roundTrip.Notarius.ConfigProfile == nil || *roundTrip.Notarius.ConfigProfile != "" {
+		t.Fatalf("round-trip config profile = %#v, want explicit empty", roundTrip.Notarius)
+	}
+	if roundTrip.Notarius.LLMAPIKey == nil || *roundTrip.Notarius.LLMAPIKey != "NARRATIO_TEST_NOTARIUS_KEY" {
+		t.Fatalf("round-trip credential reference = %#v, want safe public name", roundTrip.Notarius.LLMAPIKey)
+	}
 
 	t.Setenv("NARRATIO_TEST_ACCESS_KEY", secondCanary)
 	t.Setenv("NARRATIO_TEST_SECRET_KEY", secondCanary)