OptionalcacheRuntime cache TTL (seconds) for this kind's getter; omit/0 = cache for the process life.
OptionalprefixStore path prefix (no trailing slash). Defaults to the kind's neutral prefix.
OptionalstageOptional environment segment; a value resolves to <prefix>/<stage>/<key> and
falls back to the shared <prefix>/<key>.
⚠️ stage is NOT a security boundary. To make the fallback work, the IAM
grant is static and gives the compute standing read on both the stage
locator and the shared <prefix>/<key>. So every stage sharing a prefix can
read the shared value — keep production-only secrets in a stage-scoped slot,
and put only a safe cross-stage default (e.g. a sandbox credential) in the
shared slot. Two Hosting/Pipeline constructs sharing a prefix are not
isolated from each other.
Per-kind namespace/cache config (one for
secretStore, one forconfigStore).