Treat null secret readback as sealed, not necessarily absent
Secret-management APIs may return a configured key with a null value to represent sealing, so null readback is not by itself evidence that the variable is absent. Verify three separate facts without exposing the secret: the key exists in the exact project/service/environment, the…