augustash/drupal-qa is not on Packagist yet; thronedigital/drupal-qa
already is. The package paths follow the name, and callers pass the
secrets by name because secrets: inherit doesn't cross accounts.