Secrets

Values never leave the broker. Sandboxes receive hlsec_ handles with 15-minute leases. Reference secret://NAME in agent.yaml.