Implement Runtime Bindings doctor and explain

[zack-nova]

Summary

• Adds schema 2 Runtime Bindings selected resolution for scoped bindings, global bindings, declaration defaults, and unresolved required variables.
• Adds P0 hyard vars doctor and hyard vars explain <name> text/JSON diagnostics.
• Propagates declaration sensitive and default metadata through template, install, bundle, and manifest snapshots.

Linked Issue

Closes #138

Dev Brief Mapping

• Acceptance criterion 1: scoped Runtime Bindings win before global Runtime Bindings, declaration defaults, and unresolved required variables.
• Acceptance criterion 2: declaration defaults report as source: default and are not written to .harness/vars.yaml by resolution.
• Acceptance criterion 3: value_from.env resolves from process env and non-sensitive value_from.file resolves file content for selected variables.
• Acceptance criterion 4: hyard vars doctor reports P0 errors for invalid schema, missing required bindings, malformed value sources, and unset env sources.
• Acceptance criterion 5: hyard vars doctor reports P0 warnings for undeclared bindings and missing file sources.
• Acceptance criterion 6: hyard vars explain [name] reports status, selected source, required/sensitive flags, redaction placeholder, declaring ids, and selected scope in text and JSON.
• Acceptance criterion 7: P0 doctor/explain do not implement template usage scanning, unknown template reference scanning, shadowed candidate display, or full precedence trees.

What Changed

• Added cmd/orbit/cli/bindings selected-resolution support and tests.
• Added harness-level doctor/explain result builders and tests.
• Added hyard vars doctor and hyard vars explain <name> wrappers with --json.
• Preserved declaration default/sensitive metadata across manifest and install-record paths.

Validation

• Command: mise run fix
• Result: passed
• Command: mise run ci
• Result: passed
• Command: sh ./scripts/test_release_surface_hyard.sh
• Result: passed
• Manual verification: not required; AFK automated gates covered the public command behavior.

Risk

• Medium: touches shared variable declaration metadata plumbing and public hyard vars output. Covered by focused resolution/CLI tests plus full repository validation.

Out of Scope

• Template usage scanning.
• Unknown template reference scanning.
• Shadowed candidate display.
• Full precedence trees.
• Secret-manager integration.

Reviewer Notes

• Sensitive resolved values are redacted as <redacted> in explain output.
• value_from.file is rejected for sensitive declarations during selected resolution diagnostics.