Write secret values through the tenant's selected provider

Writes one or more secret values through the tenant's selected writable secret provider and returns the canonical reference for each key. Values are write-only; only the resulting references are returned so they can be stored in configuration. The selected provider must be writable - a read-only provider (such as the environment floor or a Kubernetes secret mount) is rejected.