Credential non-exposure: inject secrets upstream so the agent never sees raw keys

Motivation. coop hardens how secrets enter the guest (kept off argv, redacted, passed via stdin), but the agent can still read any credential once inside — so a prompt-injected or rogue agent can exfiltrate it, and the VM boundary doesn't help (egress is open today; see #2). Even a server-scoped token (#73) leaks its scope if the agent can read it.

Idea. Run an L7 proxy that injects auth into upstream requests so the agent never holds the raw secret. coop already runs this exact plumbing for local models (ANTHROPIC_BASE_URL → host gateway, see #62), so the seam already exists.

Scope. A host-side injecting proxy on the guest's egress path: the agent points at a loopback/gateway endpoint; the host holds the secret, injects Authorization, and forwards upstream. Shares the networking seam with #2's egress filter.

Open design question — general injecting proxy vs. per-integration.

• One general injecting proxy — a single host-side proxy on the egress path handles all credentials. Pro: closes the pattern uniformly, one place to audit, composes directly with the #2 egress filter. Con: bigger build — must terminate TLS for arbitrary upstreams (a guest-trusted MITM CA to manage), handle SSE streaming and tool-use round-trips, and carry per-service injection rules.
• Per-integration — each credential handled by its own mechanism (Anthropic via the #62 host relay, GitHub via #73 server-scoping, etc.). Pro: incremental, each piece is simpler and independently shippable, and avoids a guest-trusted MITM CA. Con: leaves gaps — any integration without a bespoke path still hands the agent a raw key — and duplicates injection logic across services.

Caveats. Whichever path: must handle SSE streaming + tool-use round-trips and TLS termination (non-trivial — a genuine build, not a quick win); ship with sane defaults so it doesn't force policy authoring.

Relationships. Generalizes the #62 host-relay follow-up (the model-API instance); complements #73 (server-enforced scope) and #2 (egress control).

Start by reading the local-model host relay described in #62 and the egress-filter seam in #2. Resolve whether the work should be a general injecting proxy or per-integration mechanisms, then define how the chosen design handles TLS termination, SSE streaming, tool-use round-trips, and sane default policy without exposing raw credentials to the agent.