BDD DSL: Prepare self-managed stack secrets

[sbaum1994]

Why

Several features repeat a copy from secrets.yaml.template followed by substitution of a base64-encoded NGC registry credential. The explicit source and destination matter, but the encoding and placeholder mechanics do not improve readability.

Scope

Add a step that prepares an explicit self-managed secrets destination from an explicit secrets template using the current NGC registry credential.

Acceptance criteria

• Add the step to the documented DSL catalog.
• Keep the template and destination paths visible and support ${VAR} interpolation.
• Snapshot the destination through the suite ledger before its first write.
• Preserve the existing $oauthtoken:<NGC_API_KEY> base64 credential format.
• Keep the API key and encoded credential out of Gherkin, command logs, and failure messages.
• Add focused helper, handler, ledger, and secret-hygiene tests.
• Migrate suitable copy-and-substitute pairs without changing their destination files.
• Pass affected wiring tests and live feature tests.

Parent: #858