feat(_task): allow secret overrides on reusable tasks

[EngHabu]

Motivation

task.override(secrets=...) currently raises when the task's environment is reusable:

ValueError: Cannot override secrets when reusable is set. Reusable tasks
will use the parent env's secrets. You can disable reusability and
override secrets if needed. (set reusable='off')

The guard's intent — keep one actor pool per env — is already enforced downstream. extract_unique_id_and_image (in _internal/runtime/reuse.py) hashes the task's security_context into the actor pool key. A secret override deterministically maps to a different actor pool, not a polluted shared one.

Concrete use case

We're building a multi-user "Claude Code in Flyte" service where each user owns a per-identifier credentials secret (<identifier>-claude-session). The launcher does:

pinned = claude_session.override(
    secrets=flyte.Secret(key=secret_key, mount=SECRET_MOUNT),
)
return await pinned(...)

We want claude_session to be reusable so multiple concurrent sessions for the same user share an actor pod (and the same FUSE-mounted volume at /root). Cross-user isolation comes from the secret override → different actor pool. The current guard blocks this entirely; reusable='off' would cost us the pool sharing we explicitly want.

What changed

Drop the secrets check from the reusable guard in Task.override(). Resources and env_vars stay locked — they would mutate the pod spec without changing the actor pool key (so a single pool could end up running tasks that disagree on CPU/memory limits or environment values).

Test plan

• Existing reusable smoke tests still pass.
• Manually verified that task.override(secrets=...) on a reusable env now schedules into a per-secret actor pool (rather than raising at override-time).
• Add a focused unit test covering the new allowed override path (happy to follow up).

🤖 Generated with Claude Code