Summary

Phase 5 of the scoped secret store implementation (#4192).

Provides a privileged escape hatch for operators who need to inspect or delete system-managed secrets directly, without going through the scoped wrappers.

Work

• --system flag on thv secret list to include system-reserved keys in output
• --system flag on thv secret delete to allow deletion of a system-reserved key
• Both flags require explicit opt-in and display a warning
• E2E tests covering flag behaviour

Dependencies

Depends on Phase 4. This is the last phase — the feature is complete once this ships.