Credential onboarding

Do not put credential values in this file, Git, generated configuration, command arguments, terminal history, or logs.

Obtain written authorization for <credential-purpose>, <consumer-inventory>, <approved-scope>, and <rotation-window>.
Have the authorized operator enter <credential-value> only through the approved secure prompt or standard input boundary.
Store it only in the configured SOPS-encrypted operational-secrets file, then reseed and verify OpenBao before changing consumers.
Keep the previous credential active only for the approved overlap window; revoke it only after every consumer check succeeds.
Record <credential-identifier>, <timestamp>, <operator>, and <status> without recording any credential value.