NCL Pipe Bootstrap — Config Validation and Secret Injection via Unix Pipeline

Ontoref-daemon and any process that receives structured config faces two problems: (1) Nickel NCL requires a subprocess to evaluate, introducing a system-call injection surface if the daemon itself cal