Define secret brokering and runtime output protection

## Parent and milestone

- Parent issue: #43
- Milestone: not scheduled; implementation remains gated by #15.

## Problem

Long-running agents and plugins can inherit broad environment credentials and
emit sensitive values into logs, SQLite, Telegram, artifacts, or remote plugin
requests.

## Outcome

Define a secret-broker and data-protection boundary for temporary credentials,
data classification, least-privilege delivery, redaction, revocation, and audit.

## Scope

- Resolve secret references only for authorized run/runtime/plugin scopes.
- Prefer short-lived credentials and revoke them on completion or cancellation.
- Define classifications for prompts, source, output, artifacts, diagnostics,
and remote delivery.
- Apply bounded redaction before persistence and transport while retaining
protected forensic references where policy permits.
- Deny networked plugin access to data classes outside explicit grants.

## Non-goals

- Implementing a new general-purpose vault.
- Claiming regular expressions provide complete data-loss prevention.
- Persisting secret values in manifests, logs, or configuration.

## Acceptance criteria

- [ ] Secret values are never stored in task, plugin, manifest, or audit data.
- [ ] Access is scoped, attributed, expiring, revocable, and least privilege.
- [ ] Output protection covers Telegram and future API clients consistently.
- [ ] Unsupported secret or redaction guarantees reject configuration.
- [ ] Exfiltration, crash, retry, and cleanup scenarios are specified.

## Validation

- Canary-secret tests across runtime output, plugin calls, artifacts, errors,
retries, cancellation, and remote transports.

## Dependencies

- #14 configuration and secret references, #24 plugin permissions, #41 control
API, and #44 execution isolation.

No implementation files or entry points are named. Start by reading dependent issues #14, #24, #41, and #44 to identify the configuration, plugin, control API, and isolation boundaries. Done means the listed acceptance criteria are specified and canary-secret tests cover runtime output, plugin calls, artifacts, errors, retries, cancellation, and remote transports.

Written by the indexing model from the issue text.