v0.37.1

The DuckDB extension is not adding a vgi_attach secret type. Credential
attach options are passed inline and declared secret; the extension
redacts them from duckdb_databases(), keeps only a salted hash in its
cache key and never logs them. To keep a credential out of the SQL text,
write it as an expression: api_key getenv('SALES_API_KEY').

Documentation only; no behavior change.

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com