Function spawn_secret_watcher 

pub fn spawn_secret_watcher(
    source: Arc<dyn SecretSource>,
    key: &'static str,
    interval: Duration,
    on_change: impl Fn(SecretVersion) + Send + Sync + 'static,
)

Poll source for key every interval; when the version increases, invoke on_change with the new secret.

Spawn from ArclyPlugin::on_start — the existing lifecycle hook — so no new mechanism is needed for graceful shutdown (the task dies with the runtime). Fetch errors are logged and retried on the next tick; the previous key material stays live, so a flaky source can never lock the service out of its own keys.