settings: three tiers - wikitool.json (instance), .wikitool-local.json (checkout), secrets by reference incl. 1Password CLI; new command config set (#207)

Every settings field declares its tier; a value in the wrong file is an error naming
file, key and tier. A field naming a program or affecting a gate cannot be declared
instance. Secrets are references only: {"ref": "<name>"} via WIKITOOL_SECRET_<NAME> or
a user-only secrets file, {"ref": "op://..."} via op read (locked 1Password: exit 42).
The preflight records op as an optional tool. doctor gains one line per tier, docs
verify checks a committed wikitool.json for plaintext secrets, CI resolves a real
op:// value through 1password/load-secrets-action. No feature reads its settings
this way yet; without the two files every other command is unchanged.

Files changed:
- .gitea/workflows/ci.yml
- .gitignore
- AGENTS.md
- CHANGES.md
- INSTALL.md
- VERSION
- docs/explanation/README.md
- docs/explanation/configuration-tiers.md
- docs/how-to/README.md
- docs/how-to/use-1password-for-settings.md
- docs/reference/commands/README.md
- docs/reference/commands/configuration.md
- docs/reference/commands/instance-health.md
- docs/reference/commands/types-instructions-and-docs.md
- docs/reference/configuration.md
- docs/reference/exit-codes.md
- instructions/dev/doc-pull-through.md
- instructions/dev/testing-conventions.md
- instructions/preflight.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/cli_contract.py
- tools/chemenu/commands/_util.py
- tools/chemenu/commands/config_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/config.py
- tools/chemenu/config_shapes.py
- tools/chemenu/prerequisites.py
- tools/chemenu/settings.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_dist_cmd.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/chemenu/tests/test_settings.py
- tools/chemenu/toolpaths.py
- tools/preflight.ps1
- tools/preflight.sh
- tools/prerequisites.txt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

.gitea/workflows/ci.yml

@@ -82,12 +82,14 @@ jobs:
       - name: System dependencies
         # `nodejs` is not for us - it is what act_runner needs to execute the
         # JavaScript action in the next step. It has to be installed before the
-        # checkout, which is why this step comes first.
+        # checkout, which is why this step comes first. `curl` and `unzip` are
+        # for 1Password's action further down, which fetches its own CLI - the
+        # set proven by torben/gitea-mcp@ci-binford, binford-release.yaml.
         run: |
           set -eu
           apt-get update -qq
           apt-get install -y --no-install-recommends \
-            python3 python3-venv git nodejs ripgrep ca-certificates
+            python3 python3-venv git nodejs ripgrep ca-certificates curl unzip
           rm -rf /var/lib/apt/lists/*
 
       - uses: actions/checkout@v7
@@ -145,6 +147,37 @@ jobs:
           .venv/bin/python -m pytest -q \
             --cov --cov-report=term --cov-report=xml --cov-report=html
 
+      - name: Load a real secret reference from 1Password
+        # The CI half of the tiered settings (tools/chemenu/settings.py). Of the
+        # two ways a configuration reaches 1Password in CI - `op` itself with a
+        # service-account token, or an action resolving the `op://` references
+        # into variables first - this is the second, the shape this Gitea
+        # instance already runs (torben/gitea-mcp@ci-binford,
+        # binford-release.yaml). A `{"ref": "ci_smoke"}` then resolves through
+        # `WIKITOOL_SECRET_CI_SMOKE`. The token is a user-level secret whose
+        # service account sees only the CI-CD vault; the field read is a
+        # username, the least sensitive value that vault holds, and the action
+        # masks it in the log all the same. A pull request from a fork gets no
+        # secrets, so this step fails there - nobody but the operator pushes here.
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          WIKITOOL_SECRET_CI_SMOKE: op://CI-CD/gitea-package-token/username
+
+      - name: Secret references resolve in CI
+        # `CHEMENU_LIVE_SECRET_REQUIRE=1` turns "no value loaded" into a failure:
+        # without it the test skips and stays green, which is the outcome this
+        # step exists to rule out - the same reason the CalDAV step below sets
+        # `CHEMENU_LIVE_REQUIRE`.
+        env:
+          CHEMENU_LIVE_SECRET_REQUIRE: "1"
+        run: |
+          set -eu
+          cd tools
+          .venv/bin/python -m pytest -q chemenu/tests/test_settings.py -k live_secret
+
       - name: Start Radicale
         # Its own step because the script hands the server's address to the suite through
         # $GITHUB_ENV, which only reaches the steps after the one that wrote it.