A run gets exactly the secrets it declares, for exactly that run, and never in a transcript #336

A crew run that drives infrastructure (OpenTofu against Cloudflare, a bucket) needs a credential for the length of the run and not a second longer. The forge already does this for its own token: FORGE_TOKEN with an expiresAt, deleted when the run ends (src/core/tokens.ts, src/crew/runner.ts).

Intent: an issue or an agent brief declares secret names; the runner resolves them (secrets table, narrowest scope), injects them as env beside FORGE_TOKEN, widens the sandbox egress allowlist by the hosts those secrets are for (e.g. api.cloudflare.com) for that run only, passes every injected value through redactSecrets before anything reaches logs, transcripts or events, and drops the grant when the run ends.

Acceptance:

• [ ] a declaration (issue front-matter or brief field) names the secrets a run may receive; undeclared names are refused
• [ ] injection via the runner's env map; the grant is recorded and removed at run end (crash included)
• [ ] per-run egress allowlist extension, logged by host name
• [ ] redactSecrets applied to run log, transcript and event payloads; a test plants a value and proves it never appears
• [ ] the run page says which secret names a run held, never values

Files: src/crew/runner.ts, src/crew/sandbox.ts, src/kernel/log.ts, src/core/secret_store.ts. Risk: a model echoing a value into a file it commits — the redaction test must include a committed file. Depends on the secrets table.

Parked by the crew: main moved under it 2 times and the branch could not be brought up to date (src/core/schema.ts) (pull #369 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.