bug(doeff-secret): env fallback handler yields removed Delegate — RuntimeError on every fallback path

Start in packages/doeff-secret/src/doeff_secret/handlers.py and compare its fallback handling with doeff_core_effects/handlers.py. Use rg -n 'Delegate' packages/doeff-secret/ to find all affected references, then run or extend the doeff-secret tests for a missing GetSecret key with an inner handler. Done means the fallback propagates without RuntimeError, the search returns zero hits, and the relevant suites pass.

Problem

packages/doeff-secret/src/doeff_secret/handlers.py:8 does from doeff import Delegate, but Delegate is a _Removed stub (doeff/init.py:159) that raises RuntimeError('Delegate was removed: use yield effect to re-perform in handler body') when called.

Both fallback paths in the env-var handler hit it:

• handle_get_secret: non-GetSecret effect → yield Delegate() (handlers.py:~68)
• secret not found in environ → yield Delegate() (handlers.py:~76)
• outer handler: any non-GetSecret effect → yield Delegate() (handlers.py:~86)

So the handler crashes the moment any effect passes through it or a secret is missing. Discovered during the 2026-06-12 algebra coverage measurement (docs/crystallization/coverage-report.md 発見①). Migration leftover from the Delegate→Pass unification (constraint-graph.md B9; VM errors on Delegate at step.rs:258-264).

rg shows no external users of env_var_handlers — broken but unexercised.

Fix

Replace each yield Delegate(); return None with the Pass idiom used everywhere else (see doeff_core_effects/handlers.py reader/state/writer for the canonical shape):

yield Pass(effect, k)

and drop the Delegate import. Check the rest of doeff-secret for the same pattern (rg -n 'Delegate' packages/doeff-secret).

Verification

1. rg -n 'Delegate' packages/doeff-secret/ → zero hits
2. Add/extend a test that drives the fallback path: GetSecret for a missing key with an inner handler below — must propagate (not RuntimeError)
3. Full doeff-secret test suite green; repo test suite green