com.dustforge

Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.