Function resolve_secrets 

pub fn resolve_secrets(
    vault: &Vault,
    murk: &Murk,
    pubkey: &str,
    tags: &[String],
) -> BTreeMap<String, Zeroizing<String>>

Merge private overrides over shared values and filter by tag. Returns raw (unescaped) values suitable for env var injection.

Values are wrapped in Zeroizing so plaintext is cleared from memory when the returned map is dropped.