pub fn set_runtime_flags( allow_plaintext: bool, secrets_key_file: Option<PathBuf>, use_keyring: bool, )
Applies one-shot CLI flags for secrets resolution (GAP-AUD-006).