Function default_secrets 

pub fn default_secrets() -> &'static Secrets

Process-wide default Secrets façade. The first caller wins; the lock is exposed so test or CLI code can install an explicit backend (e.g. an codewhale_secrets::InMemoryKeyringStore) before any resolver runs.