feat(procmgr): secret backend resolution for config gates (split PR 3/4)

Resolve ENC[...] gate values via secret_backend_command and native backends,
matching Agent precedence and spawning backends under the core Agent account.

Author: jose-manuel-almaza

pkg/procmgr/rust/src/config_gate.rs

@@ -18,6 +18,8 @@
 //! registry first, then dd-procmgr's process environment, so service-local
 //! overrides match agent config resolution.
 
+use super::secrets;
+
 struct EnvBinding {
     key: &'static str,
     env_vars: &'static [&'static str],
@@ -101,13 +103,13 @@ pub(super) fn env_vars_for_key(key: &str) -> &'static [&'static str] {
         .unwrap_or(&[])
 }
 
-pub(super) fn env_bool_for_config_key(key: &str) -> Option<bool> {
+pub(super) fn env_bool_for_config_key(key: &str, agent_yaml: &str) -> Option<bool> {
     let names = env_vars_for_key(key);
     if !names.is_empty() {
-        return env_bool_from_names(names);
+        return env_bool_from_names(names, agent_yaml);
     }
     let auto = auto_env_var_for_key(key);
-    env_bool_from_names(&[&auto])
+    env_bool_from_names(&[&auto], agent_yaml)
 }
 
 /// Whether any env var bound to `key` is set to a non-empty value (mirrors Go `IsConfigured` env source).
@@ -152,15 +154,26 @@ fn env_var_nonempty(name: &str) -> bool {
     env_var_value(name).is_some()
 }
 
-fn env_bool_from_names(names: &[&str]) -> Option<bool> {
+fn env_bool_from_names(names: &[&str], agent_yaml: &str) -> Option<bool> {
     for name in names {
         if let Some(value) = env_var_value(name) {
-            return Some(super::parse_agent_bool_string(&value).unwrap_or(false));
+            return bool_from_env_string(&value, agent_yaml);
         }
     }
     None
 }
 
+fn bool_from_env_string(value: &str, agent_yaml: &str) -> Option<bool> {
+    let resolved = secrets::resolve_config_string(value, agent_yaml);
+    if let Some(enabled) = super::parse_agent_bool_string(&resolved) {
+        return Some(enabled);
+    }
+    if secrets::is_enc(value) {
+        return None;
+    }
+    Some(super::parse_agent_bool_string(value).unwrap_or(false))
+}
+
 /// Core Agent SCM `Environment` overrides, then dd-procmgr process env.
 /// SCM wins when present so config gates match agent service-local resolution.
 fn env_var_value(name: &str) -> Option<String> {