feat: add structured caller context

[domenkozar]

What changed

• Add a structured caller context (name, optional version, operation, and non-secret resource) to the Rust core and CLI.
• Record and render caller context in audit events separately from the user-supplied access reason.
• Propagate caller context through the FFI and the Go, Python, Ruby, Node.js, Haskell, C#, PHP, and Swift SDK builders.
• Document the new CLI and SDK APIs as targeting SecretSpec 0.20+.

Why

Software integrations need to identify what invoked SecretSpec without overloading or replacing the human-readable reason for accessing a secret. Keeping caller metadata separate preserves require_reason semantics while making audit records easier to attribute.

User impact

Integrations can attach stable structured metadata to secret access. Caller context remains informational, never satisfies require_reason, and is explicitly documented as unsuitable for credential or secret values.

Validation

• devenv shell -- cargo test --all
• devenv tasks run devenv:git-hooks:run --show-output
• devenv shell -- bash scripts/ci-sdks.sh
• devenv shell -- npm --prefix docs run build
• git diff --check origin/main...HEAD

Swift tests were not run locally because the Swift toolchain is unavailable in this environment; the repository's macOS CI covers them.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	secretspec	b1ce6f9	Commit Preview URL Branch Preview URL	Aug 13 2026, 12:11 AM