Add a secret to Agent Vault

Agent Vault sits between an agent and target services, attaching real credentials to outbound requests, so the agent calls an API through the proxy without ever holding the key.

The value must never enter your context. You supply the credential name; the human supplies the value. Never ask for, echo, or accept the secret in chat, and never read it back with credential get.

1. Configure the instance

Once per host. The host, SSH user, container, and vault belong to the consumer, so the scripts ship with no defaults. Write them to ${XDG_CONFIG_HOME:-$HOME/.config}/agent-vault-secret/config: