Fix CDN encrypted manifest secret cache leak

[cursor]

Summary

• cache encrypted CDN manifest envelopes instead of decrypted payloads
• strip artifacts.secrets from any plaintext CDN manifest cache entry
• purge legacy plaintext cache entries that contain runtime secrets after loading
• add focused tests for sanitized cache entries and in-memory secret availability

Validation

• git diff HEAD~2..HEAD --check
• flutter test modules/ensemble/test/cdn_provider_test.dart (fails locally: flutter is not installed in this environment)

Duplicate check

• Checked open PRs, recently closed/merged PRs, related CDN/security branches, commit history, and GitHub issues for cdn_provider, encrypted manifest, artifacts.secrets, SharedPreferences, and plaintext secret cache handling.
• Existing CDN automation PR Fix CDN invalid manifest cache recovery #2197 fixes invalid manifest cache recovery, not decrypted secret persistence.
• Existing security-review/application-security branches cover WebView/Bluetooth/workflow findings, not CDN manifest cache secrets.