I think to follow their guidance on a Microsoft Windows platform, one must have a strong understanding of the platform.
Following your lead about the 3rd factor, the suggestion of storing the configuration in the environment, we should ask ourselves what exactly are environment variables in the Windows platform. The answer is the Windows Registry. Now, I do ply my trade developing a server application which makes use of the Windows Registry, and given my role (I do care about the continuous integration, the build and the installers), I do truly hate with a vengeance that we have to use the Windows Registry, but that's what you do in the Windows platform.
Windows Registry obviously fail on the language- and OS-agnostic standard, but even if you resort to use plain vanilla environment variables, on the Windows Platform those are
implemented in Windows Registry keys.
I do from time to time commit the sin of storing credentials in the SCM (by the way, in recent years mostly TFS), but never for the application itself, mostly for the build infrastructure (that is, stuff which will never be deployed on customer sites or deployments, and which is fully segregated from the application code).
You could use the app/web.config to store credentials (there are also encryption functionalities), but that's generally a bad idea.
Also, if you use a database as back-end (relational, non relational, any kind of database really), some configuration may well end up there, some configuration may even more suited to be stored there (i.e. on a multi-tenant application, you really wish to segregate tenant related configuration, and more often than not shared configuration end up lumped in a tenant 0 special store), as long as you can store and retrieve (i.e. in the Registry) the key to open the door that brings you there.
About the second question, being new to the 12factor manifesto (but from what I could read so far, not to the underlying concepts), I'd not be able to give you at this point a suggestion for a reference architecture on .Net.
UPDATE about the 2nd question
Also, about the other question, I'd say the 2nd factor, dependencies, is what may prevent us to find a good reference implementation on Microsoft platforms, if we take a literal and strict approach.
Stuffs like Windows Installer and higher level install authoring tools (Wix, InstallShield, ..) aren't really comparable with RubyGems or CPAN, and NuGet is not yet there in terms of popularity.
You could look for a reference implementation looking at NuGet feeds, even if the authors didn't knew of 12factor, the manifesto is requesting pretty sensible things, good developers will have mostly followed those or pretty similar concepts anyway.
As an example of this approach, I would advise you to give a look at Ayende's RavenDB, you may get it through NuGet, and I suspect it would tick most, if not all, the 12factor guys boxes (intro, features and source code).