CC secrets build: consumers switched to sec, S19 age key in the recovery runbooks, evidence (R-1118, R-1122)

Build skill (hub token, ISO publish), fb_probe (token from `sec run` env, tests red-proved), secrets.md (Resend:
pipe inside sec run), bench README, read_credential docstring, 12-agent-tooling §5, workspace CLAUDE secrets line.
Evidence: audits/cc-creds-build-2026-10-17/ (tests, red-proofs, 36-row child-session proof both launch modes,
install, fresh-session proof, import names+lengths, history sweep names).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

scripts/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 2026-10-17 — the CC secret broker `sec` replaces `~/.config/credentials` for CC (R-1118, R-1122)
+
+The tool itself lives in the private repo `admin/cc-secrets` (its own CHANGELOG). Here: the consumers.
+- `facebook/fb_probe.py`: the token comes from the environment when run as `sec run FACEBOOK_API -- python3 fb_probe.py …`,
+  with the same shape checks; the old file stays a fallback until it retires. Tests `TokenFrom` (3), red-proved (the
+  environment ignored → 2 errors).
+- `read_credential.py`: docstring points at `sec`; behaviour unchanged.
+- `bench/README.md`: the Tuya credentials belong in the store (they are not in it yet, nor in the old file).
+- Docs, not scripts: `skills/felhom-build-deploy/SKILL.md` (hub token and ISO publish through `sec run`, values never on a
+  command line — both recipes proven 2026-10-17: a local server saw the token's hash, a read-only `lsf R2:felhom-iso`
+  listed the bucket), `runbooks/secrets.md` (Resend recipes; the pipe into `kubectl apply` must be INSIDE `sec run`),
+  `runbooks/total-loss-of-dooplex.md` + `break-glass-sheet.md` (S19, the age key — where, never what),
+  `architecture/12-agent-tooling.md` §5, `runbooks/workspace-CLAUDE.md` (one line: secrets through `sec`).
+
 ## 2026-10-17 — CI workflow: a manual proof that the failure mail can be sent (R-1129)
 
 `.gitea/workflows/gates.yml` gains a manual `workflow_dispatch` trigger with one input, `force_alarm` (default false), and