feat: centralize workflow credentials

docs/plans/workflow-system.md

@@ -47,18 +47,19 @@ restarted Kitty and closed the user's terminal session.
   invocation-scoped test overview and queue listing passed. Test API login,
   Yookr administrator read, rules read, aggregation login, and management health
   passed. Account login plus a raw-token management user read also passed.
+  The approved user-key SOPS authority now contains active credentials and ten
+  provenance-preserving archive namespaces. Its workbench exports passed a test
+  API login, RabbitMQ overview, MySQL test/live `SELECT 1`, MongoDB test/live
+  `ping`, and read-only Irristaud object-storage listing.
 
 ## Active pilot gates
 
 These gates do not block work on each other.
 
-- Configure one `rclone` S3 remote per Leafcloud project, starting with the
-  `irristaud` project and container. Use listing and download operations only;
-  uploads are out of scope. Project-scoped EC2 access and secret keys remain the
-  missing input.
-- Add the four named Dadbod connections after receiving MySQL test/live and
-  MongoDB test/live connection URIs. Create a Marimo-to-HTML report only when a
-  concrete cross-system investigation gives it durable value.
+- Activate the pending Neovim configuration, explicitly authorize the changed
+  workbench `.envrc`, and confirm Dadbod shows the four centralized test/live
+  connections. Create a Marimo-to-HTML report only when a concrete cross-system
+  investigation gives it durable value.
 - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
 - Wait for a real Monday ticket before adding anything beyond native GitHub,
   Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex
@@ -132,7 +133,8 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 - `yookr-workbench` starts with cross-system work only; isolation and additional
   tools wait for observed needs. Its one API environment catalogue covers the
   Yookr, rules, aggregation, and management APIs; Kulala owns requests and
-  Dadbod's native store owns named database connections.
+  Dadbod receives the four named database connections from the workbench's
+  SOPS-derived environment.
 - The reviewed `yookr-api/openapi.yaml` remains the usable local contract. The
   deployed generated document's dangling `ReadParameters` reference is accepted
   for now and does not block direct API requests.
@@ -149,9 +151,10 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 - The fine-grained GitHub token and Context7 key stay in mode-0600 machine-local
   files and are exposed only to their callers. Secrets do not enter Nix or broad
   process environments.
-- The value-free credential audit and proposed central SOPS authority are in
-  [`credential-consolidation.md`](credential-consolidation.md). Do not migrate
-  plaintext sources until the user accepts the authority and migration order.
+- The credential audit and approved central SOPS authority are in
+  [`credential-consolidation.md`](credential-consolidation.md). The authority is
+  active, while original plaintext sources remain pending consumer-specific
+  verification and explicit removal approval.
 - `sync/notes` is the single notebook owner. Daily notes, meetings, and raw
   transcripts have separate paths, and agents do not create issues or ingest
   transcripts automatically.
@@ -172,7 +175,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 
 ## Next step
 
-Agree on the proposed central SOPS credential authority, obtain Leafcloud S3
-credentials from the `irristaud` project, and resume issue 197 from a Codex
-session launched inside Herdr. Then complete database/S3 access checks and the
-real workbench and Herdr pilots without mutating company GitHub.
+Activate the pending Neovim change, authorize the changed workbench `.envrc`,
+and confirm the four Dadbod names. Resume issue 197 from a Codex session launched
+inside Herdr, then complete one real cross-system investigation and the Herdr
+pilot without mutating company GitHub.