Upstream `EncryptedObject`

https://github.com/jenkinsci/cursor-origin-branch-source-plugin/blob/4dea2eccd9984a9ab75990fc6aa7ae485610e09d/src/main/java/io/jenkins/plugins/cursor_origin_branch_source/EncryptedObject.java#L23 should contribute to core and verify that the result works here.

https://github.com/jenkinsci/cursor-origin-branch-source-plugin/blob/4dea2eccd9984a9ab75990fc6aa7ae485610e09d/src/main/java/io/jenkins/plugins/cursor_origin_branch_source/EncryptedObject.java#L137 probably needs `PluginManager.uberClassLoader`.

https://github.com/jenkinsci/cursor-origin-branch-source-plugin/blob/4dea2eccd9984a9ab75990fc6aa7ae485610e09d/src/main/java/io/jenkins/plugins/cursor_origin_branch_source/EncryptedObject.java#L71 should likely verify that the object is immutable: either a (boxed or unboxed) primitive, `String`, array of supported types, or `record` all of whose fields are supported types.

I also have another plugin with a `TrustedObject` that is similar but does not encrypt the contents on the agent side (uses an HMAC).

Also deprecate `SlaveToMasterCallable` in favor of a new `record`-friendly `AgentToControllerCallable`. Check for potential usages, such as in `TimeoutStepExecution`.

Start by reading the linked EncryptedObject.java, especially the lines around 23, 71, and 137, then inspect the local core integration. Check usages of SlaveToMasterCallable, including TimeoutStepExecution, and compare the proposed AgentToControllerCallable behavior. Done means the object works here, supported immutability is verified, and relevant usages are accounted for.

Written by the indexing model from the issue text.