Preserve Swarm secret mount settings during rotation

[ArtARTs36]

Motivation

• Rotating swarm secrets currently recreates references via engine.NewSecretRef which hardcodes File.Name, UID, GID, and Mode, breaking compose long-syntax mounts and losing custom mount options after rotation.
• The change should preserve the original swarm.SecretReference mount configuration and only update the secret identity (SecretID, SecretName).

Description

• When applying service updates, the code now clones each existing swarm.SecretReference and sets only SecretID and SecretName on the clone instead of building a new reference from scratch. (internal/sync/step4_apply_service_updates.go)
• Matching of managed secrets is moved from mount target (ref.File.Name) to the source identity using SecretName and known SecretID versions with helper predicates secretReferenceUsesManagedSecret and secretReferenceUsesManagedSecretPath. (internal/sync/step3_process_secrets.go)
• updatingServiceSecret no longer carries a logical Path; pending update maps are keyed by the original SecretID and hold only the new Name and ID. (internal/sync/payload.go)
• Added tests that mount a secret with custom target, uid, gid, and mode and verify that after sync only SecretID and SecretName change while mount settings are preserved, covering both rotation to a temporary version and restore to the parent secret. (internal/sync/synchronizer_test.go)

Testing

• Ran go test ./internal/sync, which passed.
• Ran go test ./..., which passed across the repository.

---

Codex Task