* CLI: gate exec SecretRef dry-run resolution behind opt-in * Docs: clarify config dry-run exec opt-in behavior * CLI: preserve static exec dry-run validation
* CLI: expand config set ref/provider builder and dry-run * Docs: revert README Discord token example