fix: harden thothctl file access

tools/thothctl/internal/config/installation.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 	"sync"
 
@@ -22,6 +23,8 @@ const installationFileName = "thothii-installation.yaml"
 
 const maxEnvironmentFileBytes = 1 << 20
 
+const maxSecretSources = 32
+
 var dotenvParseMu sync.Mutex
 
 type descriptor struct {
@@ -152,8 +155,12 @@ func (i Installation) SecretFiles() ([]string, error) {
 		if _, exists := seen[value]; !exists {
 			files = append(files, value)
 			seen[value] = struct{}{}
+			if len(files) > maxSecretSources {
+				return nil, errors.New("installation secret declarations could not be read")
+			}
 		}
 	}
+	sort.Strings(files)
 	return files, nil
 }