Function default_registry 

pub fn default_registry(
    preprocessor_config: &PreprocessorSection,
    secret_config: &SecretSection,
    pather: &dyn Pather,
    command_runner: Arc<dyn CommandRunner>,
) -> Result<(PreprocessorRegistry, Option<Arc<SecretRegistry>>)>

The default registry used on the normal execution path.

Contains all user-facing preprocessors:

• unarchive::UnarchivePreprocessor for .tar.gz extraction
• template::TemplatePreprocessor for Jinja2-style templates

The identity preprocessor is test-only and is intentionally not registered here (it would match innocuous-looking .identity files in user dotfiles).

secret_config controls whether the template preprocessor gets a [SecretRegistry] wired in. When [secret] enabled = true and at least one provider is enabled, this function builds the registry, wires it onto the template preprocessor, and returns it via out_secret_registry so the caller can run preflight checks (crate::secret::preflight) before any rendering begins. When secrets are disabled, the template preprocessor is built without a registry and secret(...) calls in templates surface a config- pointing render error.