Add named-entry clone and guarded delete

[gkennos]

Pre-flight

• I searched existing issues and this has not been requested before.

Problem or motivation

After profile removal, operators commonly need a second explicitly named entry, such as a test database based on production settings but pointing at a dedicated test connection. There is no supported clone operation. Delete is also manual and can leave dangling references.

Proposed solution

def clone_entry(
    config: StackConfig,
    section: str,
    source: str,
    new: str,
) -> StackConfig:
    """Copy an entry under a new name without repointing references."""


def delete_entry(
    config: StackConfig,
    section: str,
    name: str,
    *,
    package_configs: Mapping[str, type[PackageConfigBase]],
) -> StackConfig:
    """Delete only when reverse-reference safety can be proven."""

Requirements:

• pure operations returning validated copies
• clone refuses collision and preserves the source
• secrets remain values in the provider-owned candidate but never appear in repr or presentation output
• delete refuses when references exist
• delete also refuses when an unknown tool schema prevents proving safety
• no force=True escape hatch in the first public version. Callers can construct a lower-level candidate manually if they knowingly want an invalid config.

Alternatives considered

No response