Configuration contract boundary
Configuration owns typed and versioned SettingDefinition and
SettingAssignment records plus scoped resolution and change provenance.
Effective configuration is a derived result. Secret values never enter a
setting assignment; only a SecretRef/CredentialRef crosses the secrets
boundary into an authorized adapter or runtime.