What Problem This Solves

An active Gateway secrets snapshot can resolve some command SecretRefs while leaving an exec-backed target unresolved. The previous all-or-nothing result converted that partial snapshot into secrets.resolve failure noise, after which the CLI repeated resolution locally. PR #96661 identified the user-visible failure, but its client-side bypass could discard authoritative Gateway-only values.

Fixes #96653. Supersedes #96661 while preserving @SunnyShu0925's contribution and co-author credit.

Why This Change Was Made

Keep resolution at the existing owner boundary: the Gateway returns every assignment its active snapshot resolved, even when another target remains unresolved. The existing caller then retains those authoritative values and performs local fallback only for missing paths.

This avoids a second resolution policy, preserves remote/service-only env and file values, and removes the noisy failing RPC without hiding genuine Gateway failures.

User Impact

• Reply-time command SecretRefs no longer emit an expected secrets.resolve unavailable error merely because one exec-backed target needs local fallback.
• Values already materialized by the Gateway remain authoritative.
• Mixed target sets resolve locally only where the Gateway returned no assignment.

Evidence

• Blacksmith Testbox tbx_01kxapky9sr42z94nrxr4hnnjs: 60 focused Gateway, runtime-secret, CLI, and auto-reply tests passed on the current-main replacement.
• The same Testbox passed tsgo:core and tsgo:test:src.
• Regression coverage includes a real exec provider prepared into the runtime snapshot, an incomplete snapshot with an authoritative assignment, and a mixed Gateway/local target set.
• Two fresh structured reviews of the original final patch reported no actionable findings; the current-main replacement preserves that patch and deletes the unsafe client-side bypass.

Known broad-gate context: the stale fork's delegated full-suite workspace mixed current-main tooling tests with the old fork tree, producing unrelated missing extensions/crabbox and shard-inventory failures. Recreating the patch on current main removes that workspace mismatch; hosted exact-head CI remains the landing gate.