[fix] align documentation with config visibility (STAR-93)

[vt128]

The config documentation scanner treated every option as script-writable and inferred secrecy from a single line containing “Secret”. Parse Go factory chains so multiline SetHostOnly/SetSecret declarations and explicit false overrides match base's getter/setter contract. This fixes STAR-93.

Tests cover the full host-only x secret product, both constructors, multiline and generic forms, misleading descriptions, repeated overrides, and unknown visibility expressions. Unknown non-literal flags fail clearly instead of silently inventing a surface.

The tools CI now uploads its actual coverage in addition to the reusable-workflow fixture. A manual exact-commit baseline input lets maintainers backfill a real tested baseline; it does not synthesize a result or relax gates.

Validation: build, race tests twice, vet, gofmt on Go 1.27.1; linux/amd64 Go 1.19 build and race tests. No tag or release.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.56%. Comparing base (496f380) to head (5349f63).

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #13      +/-   ##
==========================================
+ Coverage   53.31%   61.56%   +8.25%     
==========================================
  Files           4        4              
  Lines         287      333      +46     
==========================================
+ Hits          153      205      +52     
+ Misses        122      119       -3     
+ Partials       12        9       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.