refactor(rust_bridge): remove rule-gated native secret-manager selection

[devin-ai-integration]

Summary

Removes the rule-gated native secret-manager dispatch, mirroring the cache change in #43601 (CacheRule removal): SecretManagerRule, SecretManagerContext, and their RULES entries are deleted from rust_bridge/catalog.py, and the whole resolve_native_secret_manager / resolve_native_provider_reader / resolve_native_provider_writer machinery (NativeSecretManagerFactory/Runtime/Reader/Writer protocols and the NATIVE_SECRET_MANAGER binding) is deleted from rust_bridge/secret_manager.py

Native selection now happens the same way the Rust crates already resolve it: settings.secret_manager().native is readable and system is not None (no rule lookup), and config.rs::read picks the native backend from the explicitly configured client via _SecretManagerRuntime.from_client, which uses the kept capture layer (capture_secret_manager, native_secret_manager_config, NativeSecretManagerConfig, the client adapters). litellm/secret_managers/dispatch.py became a pure pass-through and is deleted; main.py calls secret_manager_handler.get_secret_from_manager directly, and the native: Final = resolve_native_* blocks in the AWS, Vault, CyberArk, and Google secret managers are removed so those methods are plain Python again

Tests: test_secret_manager.py no longer selects through rules; rollout-parametrized provider tests collapse to the Python path, and the parity tests now compare get_secret_from_manager against a from_client native handle directly, matching the rust_bridge test convention of calling each side explicitly

Test plan

• LITELLM_LOCAL_MODEL_COST_MAP=True uv run --no-sync pytest tests/unit/rust_bridge/ — 1132 passed
• ruff check clean on the touched packages

Link to Devin session: https://app.devin.ai/sessions/4eba617ab83944cf9880eb6ec149b1ac
Open in Devin Desktop: https://app.devin.ai/desktop/session/4eba617ab83944cf9880eb6ec149b1ac?variant=devin
Requested by: @yujonglee-berri

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Confidence Score: 4/5

[Critical risk] Removes rule-based gating for native secret manager selection.

Fix the separate Vault cache before merging so Rust requests stop using deleted or replaced secrets

Findings

1.  Deleted secrets remain cached ▶

Summary

This PR removes rule-based secret-manager selection from Python. Rust routes now resolve readable configured clients directly, while Python provider methods stay on Python

• Removes the secret-manager rules, dispatch wrapper, and native provider hooks
• Updates tests to compare Python reads with explicit native handles
• Vault cache updates need to stay in sync across the Python and Rust paths

_{Reviews (1) · Last reviewed commit: "refactor(rust_bridge): remove rule-gated..."}

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_remove_secret_manager_rule (5c8a61e) with main (fa3b0a6)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!