feat: external entries via .secrets.json + legacy absorb + properties rail (EGB-677 stage 1)

- .secrets.json external[] drives push/pull: type 'properties' (alias of
  gradle-properties; blob suffix stays legacy-compatible in stage 1) and
  type 'file'; same charset rails as the legacy parser
- push absorbs uncovered .secrets-files entries into the manifest
  (idempotent, gradle-properties → properties) with a delete hint
- pull: manifest wins entirely; a coexisting .secrets-files warns as
  superseded instead of being silently ignored
- basename rail generalized: properties targets must end '.properties'
  (was exact 'gradle.properties') — rc files/gitconfig still blocked;
  EGB-531 wrong-basename test updated for the sanctioned change

test/secrets.bats

@@ -1217,15 +1217,17 @@ gradle_project() {
   [ "$mode" = "600" ]
 }
 
-@test "EGB-531: target with wrong basename is refused" {
+@test "EGB-531: target with non-.properties basename is refused" {
+  # EGB-677 generalized the rail from exact 'gradle.properties' to any
+  # '*.properties' basename — shell rc files and gitconfig stay blocked.
   init_with_remote
   mkdir -p "$HOME/.gradle"
-  printf 'beaconClerkPkTest=x\n' > "$HOME/.gradle/custom.properties"
+  printf 'beaconClerkPkTest=x\n' > "$HOME/.gradle/evil.sh"
   mkdir -p "$WORK_DIR/gproj"; cd "$WORK_DIR/gproj"
-  printf 'gradle-properties ~/.gradle/custom.properties beaconClerkPkTest\n' > .secrets-files
+  printf 'gradle-properties ~/.gradle/evil.sh beaconClerkPkTest\n' > .secrets-files
   run "$SECRETS_BIN" push gproj
   [ "$status" -eq 1 ]
-  [[ "$output" == *"gradle.properties"* ]] || false
+  [[ "$output" == *".properties"* ]] || false
 }
 
 @test "EGB-531: target outside HOME is refused" {
@@ -1404,6 +1406,9 @@ gradle_project() {
   init_with_remote
   create_project_dir gproj
   "$SECRETS_BIN" push gproj >/dev/null 2>&1
+  # EGB-677: drop the bootstrap .secrets.json so the legacy manifest path
+  # is exercised (with a manifest present, .secrets-files is superseded).
+  rm -f "$WORK_DIR/gproj/.secrets.json"
   printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > "$WORK_DIR/gproj/.secrets-files"
   cd "$WORK_DIR/gproj"
   run "$SECRETS_BIN" pull gproj