feat: centralize workflow credentials

docs/workflow-discovery.md

@@ -145,9 +145,12 @@ tooling may be changed, and `yookr-workbench` is the explicit source-code
 exception.
 
 Credentials and `.env` files normally stay outside Git, the Nix store, and broad
-synchronization. The accepted `yookr-vpn.ovpn` is a narrow exception for Zenith
-and Polaris: keep it user-restricted and import it into NetworkManager without
-printing or committing its contents.
+synchronization. Machine-local Yookr credentials use the approved user-key SOPS
+authority at `~/.config/yookr/credentials.yaml`; callers expose only the fields
+they need. Original plaintext sources remain until their consumers are verified
+and removal is explicitly approved. The accepted `yookr-vpn.ovpn` is a narrow
+exception for Zenith and Polaris: keep it user-restricted and import it into
+NetworkManager without printing or committing its contents.
 
 `yookr-data-science/conf/local/credentials.yml` is a separate application-owned
 exception: Kedro resolves its named credential dataset through the conventional
@@ -159,10 +162,10 @@ and build configurations, then provide an activation command.
 
 ## Remaining pilots
 
-- Add workbench database connections and a Marimo report only for a real
-  cross-system investigation.
-- Configure one read-only-use rclone S3 remote per Leafcloud project, beginning
-  with listing and downloading from the `irristaud` container; do not upload.
+- Activate and visually confirm the workbench's four SOPS-derived Dadbod
+  connections. Add a Marimo report only for a real cross-system investigation.
+- Add another ephemeral read-only rclone remote only when credentials for a new
+  Leafcloud project become available. Irristaud listing has passed; do not upload.
 - Use the reviewed local Yookr OpenAPI contract while the accepted malformed
   generated test document remains deployed.
 - Run the complete Herdr notification, fallback-agent, and safe worktree pilot