7a7e73d310
After plugins register SecretSource backends, reset the env-loader cache and re-run load_hermes_dotenv when an enabled plugin secret source is configured. Closes the first-process bootstrap gap where import-time env load stale-outs plugin vaults (tommck / Community ask). Fail-open, no-op without plugin sources. Docs: first-process bootstrap timing on secret-source plugin guide. Tests: unit coverage for noop / enabled re-pull / discover hook. Part of #64182 plugin-interface expansion.