Bug: AWS Secrets Manager fails when multiple secrets reference the same source

[stephenwilliams]

I wanted to create an issue for this, but it will not allow me. So I am doing so here:

Summary

When multiple secrets in fnox.toml reference the same underlying AWS Secrets Manager secret (common when using json_path to extract different fields), fnox fails with a duplicate secret ID error.

Steps to Reproduce

1. Create an AWS Secrets Manager secret with JSON content:

aws secretsmanager create-secret \
  --name "myapp/config" \
  --secret-string '{"DB_HOST": "localhost", "DB_PORT": "5432"}' \
  --region us-east-1

2. Create a fnox.toml that extracts multiple fields from the same secret:

default_provider = "aws"

[providers.aws]
type = "aws-sm"
region = "us-east-1"
prefix = "myapp/"

[secrets]
DB_HOST = { provider = "aws", value = "config", json_path = "DB_HOST" }
DB_PORT = { provider = "aws", value = "config", json_path = "DB_PORT" }

3. Run fnox:

fnox exec -- env

Expected Behavior

Both environment variables are resolved:

DB_HOST=localhost
DB_PORT=5432

Actual Behavior

WARN fnox::secret_resolver: Error resolving secret 'DB_PORT': AWS Secrets Manager: API error: InvalidRequestException: Duplicate secret ID encountered: myapp/config. You cannot enter duplicate secrets in the secret ID list.

Impact

This prevents a common use case: storing multiple related secrets as a single JSON object in AWS Secrets Manager and extracting individual fields using json_path.

[rpendleton]

Looks like @jdx fixed this in #296.