OS keychain secrets for AI coding agents, over MCP. Environment-aware values, TTL/decay, linked rotation, redacted exec, and a tamper-evident audit log — local-first, no cloud account.
