Set function secret

Create or update a secret on a function. Marks the function out-of-sync; the next POST /deploy re-publishes the Lambda with the new env. Keys must match [A-Z_][A-Z0-9_]* (uppercase env-var style) and cannot start with reserved prefixes (AWS_, LAMBDA_, etc).