1.7.0 — Secretless credentials (broker-not-mount)

Move raw credentials out of the sandbox: the agent should never hold a durable root-of-trust (OAuth refresh token / long-lived API key). Adopt CB4A/broker principles AT SANDY'S SCALE (single-dev Docker tool, not a SPIRE/PDP fleet). Phased: (1) host-side credential broker over a localhost socket that holds the durable secret and hands the container only short-lived access tokens — no proxy change, no TLS termination, no provider cooperation needed; directly removes the OAuth refresh token from the container (implements HF-defender #3 'keep roots-of-trust out'). (2) OPTIONAL/later: proxy-side credential injection for raw API keys (true secretless) — deliberately breaks the proxy's no-MITM invariant for an allowlist of provider hosts; large lift, evaluate only if Phase-1 residual is insufficient. (3) DEFERRED: DPoP/sender-constraint + per-sandbox identity — track CB4A (IETF draft, exp 2026-09), don't depend on it. Design eval + the 'is the egress proxy the right injection point' verdict: docs/security/CREDENTIAL_BROKER_EVALUATION.md. Version number provisional — resequence vs 1.6.0 as needed.