Keep every credential in one store, not a per-repo copy

The repo carried a gitignored .secrets/ directory with four files. Two of them
(context7-token, gitea-token) were byte-identical copies of variables the login
shell already exported. One (gitea-host) is not a secret. The fourth
(worker-gitea-token) was the only copy anywhere, and nothing exported it, so
bridged read gitTokenEnv from an environment that never had it and every worker
push got an empty token.

All four values now live in the operator's single sourced secrets file, verified by
sha256 before the copies were removed. opencode.json reads them as {env:...}, which
.mcp.json already did. A second copy of a secret is the problem: the copy you forget
is the one that leaks or goes stale.

This makes worktree isolation load-bearing rather than a workaround. opencode.json is
tracked, so it lands in every worktree. It used to fail there, because {file:.secrets/}
pointed at files a worktree never receives and OpenCode refuses to start on a dangling
reference. With {env:...} the reference resolves, and a member would silently inherit
the primary's admin-scoped GITEA_ACCESS_TOKEN. GitWorktrees already neutralizes the
file; only its stated reason changes, and it is now a confidentiality boundary.

The port-to-opencode skill taught {file:.secrets/} as the preferred pattern, so it is
rewritten to teach the central store and to say why we moved. .gitignore keeps the
.secrets/ line as a backstop against habit.

Includes the wiki pointer, which also carries the CB-559 config-reload correction.

bridged/src/main/java/dev/ltms/bridged/session/GitWorktrees.java

@@ -35,10 +35,17 @@ public final class GitWorktrees implements Worktrees {
     /** What {@link #isolateToolSurface} writes for {@code .mcp.json}: a valid, explicitly empty server map. */
     private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";
 
-    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree; it carries
-     *  {@code {file:.secrets/...}} references to gitignored secrets that never reach a worktree, and
-     *  opencode refuses to start on a dangling reference — so it is neutralized and the worker gets
-     *  only the config its launcher writes via {@code OPENCODE_CONFIG}. */
+    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree, and it mounts the
+     *  primary's gitea and context7 servers with the primary's credentials. Neutralized so the worker
+     *  gets only the config its launcher writes via {@code OPENCODE_CONFIG}.
+     *
+     *  <p>The reason has changed shape and is now stronger. It used to be a crash: the file carried
+     *  {@code {file:.secrets/...}} references to gitignored files that never reached a worktree, and
+     *  opencode refuses to start on a dangling reference (CB-543). Those credentials now live in one
+     *  shell-level store and the file reads them as {@code {env:...}}, so in a worktree the reference
+     *  resolves instead of failing. That is worse, not better: a member would silently inherit the
+     *  primary's admin-scoped {@code GITEA_ACCESS_TOKEN}. A loud crash became a quiet privilege leak,
+     *  so this entry protects a boundary now rather than papering over a startup error. */
     private static final String OPENCODE_CONFIG = "opencode.json";
 
     /** What {@link #isolateToolSurface} writes for {@code opencode.json}: a valid, empty JSON object. */
@@ -112,8 +119,8 @@ public final class GitWorktrees implements Worktrees {
      * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
      * edits in the primary checkout while compiling its worktree, so every build it ran was of code
      * that did not contain its changes. {@code opencode.json} is the same trap one tool over — tracked,
-     * so it lands in every worktree, referencing gitignored {@code .secrets/} files that never do, and
-     * opencode refuses to start on the dangling reference. {@code .autoenv} extends the principle to a
+     * so it lands in every worktree, and it mounts gitea and context7 with the primary's own
+     * credentials, which a member must never hold. {@code .autoenv} extends the principle to a
      * config that is not tracked today: autoenv authorizes by path, so a fresh worktree path is always
      * unauthorized and its interactive prompt would block every spawn, so re-landing one must be safe.
      *