feat(dev): persist build secrets via config to avoid repeating --build-secrets flags

[collinmcnulty]

Disclaimer: I do not know Go and relied heavily on Claude for this. I think it's a small enough change that it's conceivable this just works, but please treat this more like a glorified issue than a vetted solution.

Summary

PR astronomer/astro-runtime#2974 added support for a netrc Docker build secret to enable private pip installs. However, users must pass --build-secrets id=netrc,env=NETRC_CONTENT on every astro dev invocation (start, restart, parse, pytest, build, upgrade-test).

This PR adds a dev.build_secrets config key so the secret can be declared once and picked up automatically:

# One-time setup (project-scoped):
astro config set dev.build_secrets "id=netrc,env=NETRC_CONTENT"

# Or globally:
astro config set --global dev.build_secrets "id=netrc,env=NETRC_CONTENT"

# Then all dev commands just work without extra flags:
astro dev start
astro dev pytest
astro dev parse

Fallback priority order:

1. --build-secrets flag (explicit, highest priority)
2. dev.build_secrets in .astro/config.yaml (project config)
3. dev.build_secrets in ~/.astro/config.yaml (global config)
4. BUILD_SECRET_INPUT env var (existing undocumented fallback, preserved)

Cloud deploy commands (astro deploy, astro remote deploy) intentionally do not read this config key — secrets for cloud builds should remain explicit.

Changes

• config/types.go — add DevBuildSecrets cfg field to the cfgs struct
• config/config.go — register dev.build_secrets config key with empty default
• pkg/util/util.go — add variadic fallbacks ...string to GetbuildSecretString (backwards-compatible; existing callers without a fallback are unaffected)
• cmd/airflow.go — pass config.CFG.DevBuildSecrets.GetString() as fallback at all 6 astro dev call sites

Test plan

• go test ./config/... ./pkg/util/... ./cmd/... passes (verified locally)
• astro config set dev.build_secrets "id=netrc,env=NETRC_CONTENT" persists to .astro/config.yaml
• astro dev start without --build-secrets picks up the config value
• Explicit --build-secrets flag overrides the config value
• astro deploy does not pick up the dev config value

🤖 Generated with Claude Code

[coveralls-official]

Coverage Report for CI Build 27775746430

Coverage increased (+0.005%) to 45.096%

Details

• Coverage increased (+0.005%) from the base build.
• Patch coverage: 12 of 12 lines across 2 files are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	56375
Covered Lines:	25423
Line Coverage:	45.1%
Coverage Strength:	8.0 hits per line

---

💛 - Coveralls