Extension framework P1 integration helpers (P1-5..P1-6)

[jongio]

Parent: #6853
Depends on: #6944
Related: #6856

Objective

Implement P1 integration helpers that consume P1 primitives and complete core extension auth/config integration.

Proposal IDs covered

• P1-5 Key Vault resolution via gRPC
• P1-6 Extension configuration helpers

In scope

• gRPC-based Key Vault resolution path for extension scenarios.
• Extension configuration helper APIs (read/write/merge/validation semantics).
• Integration tests for auth/config edge cases.

Out of scope

• Re-defining token/scope/http/pagination primitives (covered by Extension framework P1 core primitives (P1-1..P1-4) #6944).
• P2/P3 helper families.

Dependencies

• Requires Extension framework P1 core primitives (P1-1..P1-4) #6944 contracts to be stable.

Deliverables

• Key Vault resolution helper with deterministic error behavior.
• Configuration helper API + merge rules + validation behavior.
• Security/failure-mode tests (invalid secret refs, auth failures, missing config).
• Extension-facing examples and migration guidance.

Verification checklist

• Integration behavior documented and deterministic.
• No hidden retries or silent config fallback.
• mage preflight passes.

Definition of done

• P1-5 and P1-6 are complete, tested, and documented.