[high] Keep Pi child credentials outside the tool-visible process boundary

[SUaDtL]

Finding

The isolated Pi child receives the selected provider credential in a file or provider environment while also exposing normal read, bash, edit, and write tools. The current result guard rejects exact plaintext values, but a child can transform the same credential with Base64, hex, splitting, or another reversible encoding.

Impact

A prompt-injected or compromised child can exfiltrate the selected provider credential through an apparently valid assistant result. This violates ADR-0016 and the mutable security contract that credential material never appears in results.

Evidence

The ca-pr security reviewer reproduced the architectural gap in commit 980688f. Exact-value regressions pass, but transformed output is not structurally distinguishable from ordinary output.

Required resolution

Choose and implement one security architecture:

• Keep reusable credentials outside the tool-visible child behind an opaque authenticated inference broker or equivalent OS isolation.
• Fail stored-auth child launches closed and use a credential mechanism that is not visible to child tools.
• Explicitly narrow the accepted threat contract through a new user-attributed decision, then align the spec, controls, tests, and issue closure criteria.

Encoding blacklists are not sufficient.

Related: #372 and ADR-0016.