CC secrets build: consumers switched to sec, S19 age key in the recovery runbooks, evidence (R-1118, R-1122)

Build skill (hub token, ISO publish), fb_probe (token from `sec run` env, tests red-proved), secrets.md (Resend:
pipe inside sec run), bench README, read_credential docstring, 12-agent-tooling §5, workspace CLAUDE secrets line.
Evidence: audits/cc-creds-build-2026-10-17/ (tests, red-proofs, 36-row child-session proof both launch modes,
install, fresh-session proof, import names+lengths, history sweep names).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

scripts/facebook/test_fb_probe.py

@@ -54,6 +54,27 @@ class LoadKey(unittest.TestCase):
             self.load("FACEBOOK_APIX='%s'\n" % FAKE)
 
 
+class TokenFrom(unittest.TestCase):
+    """`sec run FACEBOOK_API -- …` puts the token in the environment; the environment wins over the file."""
+
+    def test_environment_wins_and_is_checked(self):
+        tok, src = fb_probe.token_from({"FACEBOOK_API": "EAAfromenv"}, "/nonexistent")
+        self.assertEqual((tok, src), ("EAAfromenv", "environment (sec run)"))
+
+    def test_environment_value_gets_the_same_shape_checks(self):
+        for bad in ("'EAAx'", "EAA x", "abc"):
+            with self.assertRaises(CredentialError):
+                fb_probe.token_from({"FACEBOOK_API": bad}, "/nonexistent")
+
+    def test_without_the_environment_the_file_is_read(self):
+        with tempfile.NamedTemporaryFile("w", delete=False) as fh:
+            fh.write("FACEBOOK_API='EAAfromfile'\n")
+        try:
+            self.assertEqual(fb_probe.token_from({}, fh.name)[0], "EAAfromfile")
+        finally:
+            os.unlink(fh.name)
+
+
 class Redact(unittest.TestCase):
     def test_access_token_key_dropped_everywhere(self):
         out = fb_probe.redact({"data": [{"id": "1", "access_token": "zzz"}], "access_token": "y"}, secrets=[])