Credentials & Secrets

Probe each credential / secret per the §11 table: is the key present, scoped correctly, and never exposed in artifacts? Status enum + a redacted next-action. Secret Manager — names only, never raw values.