t18696: Credential aliases and explicit provider defaults resolve at secret injection #34718

Task Brief

What

Make credential cleanup safe: declared aliases and explicit provider defaults resolve at injection time, so an old name keeps working while a canonical name is introduced, without any rename. Phase 2 of #34680 (guarantees 2, 4, 9).

Why

Renaming a stored secret silently breaks scripts, deployments and scheduled jobs that use the old name. Tools also assume one unlabelled variable (e.g. CLOUDFLARE_API_TOKEN), which today can only be satisfied by creating a hidden default.

How

• .agents/scripts/credential_inventory_store.py: add resolve-name NAME, which returns the stored canonical name for an alias. When NAME is a provider's conventional default variable (CLOUDFLARE_API_TOKEN, GITHUB_TOKEN, ...) and is not itself stored, it returns the explicitly declared default credential.
• .agents/scripts/secret-helper.sh build_secret_env: when a specifically requested name is not stored, resolve it through the registry and emit the resolved value under the requested name. run (inject all) also emits declared aliases of injected credentials. get and check resolve the same way, so the dispatch capability gate agrees with injection.
• Never infer a default: without an explicit defaults.<provider> entry, the bare variable stays unavailable.

Files Scope

• .agents/scripts/credential_inventory_store.py
• .agents/scripts/credential_inventory.py
• .agents/scripts/secret-helper.sh
• .agents/tools/credentials/credential-inventory.md

Acceptance Criteria

• With CLOUDFLARE_ACME_API_TOKEN stored and the alias CLOUDFLARE_DOMAINS_API_TOKEN declared, aidevops secret CLOUDFLARE_DOMAINS_API_TOKEN -- sh -c 'test -n "$CLOUDFLARE_DOMAINS_API_TOKEN"' succeeds and output stays redacted.
• With defaults.cloudflare set, CLOUDFLARE_API_TOKEN resolves to it. With no default, or an explicit null, the request fails exactly as it does today.
• Installs without a registry behave byte-identically (bash .agents/scripts/tests/test-secret-helper.sh passes).

Verification

Run the product path with a temporary HOME and plaintext fallback credentials, plus shellcheck and test-secret-helper.sh.

Parent: #34680

Brief Workflow

This issue body is composed under .agents/workflows/brief.md. Newly queued auto-dispatch work must pass its Dispatch Readiness Contract (brief schema v2): complete write surface, hazards and compatibility, executable verification mapped to affected surfaces, and positive plus negative/regression acceptance criteria.