secrets: the plane writes no log line

CodeQL flagged the label, not the exception: alert 298 points at
`label` and 299 at `name`, both built from config keys the walk also
carries credentials through. Logging the exception kind instead did not
help, so the log calls are gone -- from config_value, resolve_sources
and fill_env alike. Every refusal is still a raised SecretsError whose
own wording is redacted, and the source's words ride `from exc` /
`cause` for any host that prints a traceback.