CC secrets build: consumers switched to sec, S19 age key in the recovery runbooks, evidence (R-1118, R-1122)

Build skill (hub token, ISO publish), fb_probe (token from `sec run` env, tests red-proved), secrets.md (Resend:
pipe inside sec run), bench README, read_credential docstring, 12-agent-tooling §5, workspace CLAUDE secrets line.
Evidence: audits/cc-creds-build-2026-10-17/ (tests, red-proofs, 36-row child-session proof both launch modes,
install, fresh-session proof, import names+lengths, history sweep names).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

scripts/read_credential.py

@@ -1,6 +1,9 @@
 # -*- coding: utf-8 -*-
 """Read ONE value out of ~/.config/credentials, correctly, and refuse loudly when it is not.
 
+SUPERSEDED 2026-10-17 by `sec` (the CC secret store, `admin/cc-secrets` ARCHITECTURE.md): use
+`sec run NAME -- <command>`. This reader keeps working until the old file retires (R-1118 follow-up).
+
 Run:  python3 scripts/read_credential.py <KEY> <OUTFILE> [--credentials PATH]
       (OUTFILE is where the value GOES — a temp file. It is refused if it is the credentials file itself.)