The previous implementation extended `track_yaml_loads` across the entire
validation pass to catch deferred `!include` and package loads, but that also
captured framework YAML loaded internally by component validators (e.g.
LVGL's `hello_world.yaml`) and produced spurious "unresolved substitution"
warnings during the pre-validation force-load. bundle.py already had the
right pattern: a fresh post-validation re-parse plus `force_load_include_files`.
- Lift the discovery into `yaml_util.discover_user_yaml_files` and have both
`bundle.py` and `config.py` use it (DRY).
- Capture `secrets.yaml` / `secrets.yml` by the *un-resolved* listener fname
so a `secrets.yaml` symlinked to a non-secrets-named target is still
flagged for redaction.
- Add a `warn_on_unresolved` flag to `force_load_include_files` so the
discovery path (where substitutions haven't run) logs at debug instead of
warning.
- Reject `store_yaml` configs with an unencrypted API via
`FINAL_VALIDATE_SCHEMA`; an explicit `allow_unencrypted: true` opt-out
keeps lab setups working (renamed from `allow_unencrypted_api` so the
integration-test harness's naive `api:` string replacement doesn't
clobber it).
- Annotate `store_yaml_chunk_buf` with the
`cppcoreguidelines-avoid-non-const-global-variables` suppression that
matches other intentional API-side globals.
- Update unit tests to exercise the new `DiscoveredYamlFiles` shape plus a
symlink-secrets case.
J. Nick Koston
f06e96685b