References to secrets resolved at HostKit control-plane boundaries.
@type source() :: {:env, String.t()}
@type t() :: %HostKit.Secret{source: source()}
@spec env(String.t()) :: t()
@spec resolve!(term()) :: term()