v0.9.14: credential vault access for the model — use a stored secret without seeing it (Hermes pattern)

Source: tool-surface survey 2026-09-15. hermes-agent and OpenInstinct both have vault tools: the agent requests a stored credential be *used* (browser autofill, HTTP auth) without ever *seeing* it.

DIRECTION explicitly names "the refreshed Hermes desktop and its full Bot Mode as implementation references" — Hermes's vault suite is part of that reference.

## Proposal

A credential-vault tool surface over `crates/secrets`: the model names a stored credential and an allowed use; the harness injects it into the request/autofill without the value entering the transcript. This is the deeper version of the `http_request` secret-reference idea and the right long-term shape for connected apps. Design-heavy — land `http_request` first and grow into this.

Start by reading crates/secrets and the existing http_request secret-reference direction. Compare the refreshed Hermes desktop and full Bot Mode vault tools as implementation references. This issue is done only when the credential-vault tool surface and its transcript-safe use flow are designed and agreed; the payload does not define those details.

Written by the indexing model from the issue text.