CC secrets build: consumers switched to sec, S19 age key in the recovery runbooks, evidence (R-1118, R-1122)

Build skill (hub token, ISO publish), fb_probe (token from `sec run` env, tests red-proved), secrets.md (Resend:
pipe inside sec run), bench README, read_credential docstring, 12-agent-tooling §5, workspace CLAUDE secrets line.
Evidence: audits/cc-creds-build-2026-10-17/ (tests, red-proofs, 36-row child-session proof both launch modes,
install, fresh-session proof, import names+lengths, history sweep names).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

scripts/bench/README.md

@@ -29,8 +29,10 @@ Setup (done 2026-10-13, `documentation/audits/plugmeter-2026-10-13/`): a user ve
 lifetime total. Use watts × time for energy.
 
 When the plug moves address or is paired again: re-run the tinytuya wizard in `~/.config/felhom-bench/`
-(credentials `TUYA_ID`, `TUYA_SECRET`, `TUYA_DEVICE_ID` from `~/.config/credentials`, region `eu`) and
-update `plug.json`. Its output prints the key — send it to a file, never to a terminal or a log.
+(credentials `TUYA_ID`, `TUYA_SECRET`, `TUYA_DEVICE_ID`, region `eu`) and update `plug.json`. Its output prints the
+key — send it to a file, never to a terminal or a log. The credentials belong in the CC secret store and are used
+through `sec run TUYA_ID,TUYA_SECRET,TUYA_DEVICE_ID -- …` (`admin/cc-secrets`); **they are not in the store yet** —
+the old `~/.config/credentials` did not hold them either on 2026-10-17 (R-1118 build).
 
 ## plugswitch.py — switch the N100's plug (`on`, `off`, `status`)