com.dustforge/demipass

Credential custody for agents: use secrets blind ssh/http/smtp/git/db, never in context.