t18697: aidevops secret dependents: show what uses a credential before rename, rotation or revocation #34719

Task Brief

What

Add aidevops secret dependents NAME, so an operator can see what uses a credential before renaming, rotating or revoking it. Phase 3 of #34680 (guarantee 7).

Why

Checking what a rename would break needed a manual search across every repo and worktree, and it still missed a script that builds secret names from parts.

How

• New .agents/scripts/credential_inventory_dependents.py. It searches the following for the name and its declared aliases:
  • every repo path in ~/.config/aidevops/repos.json and its linked worktrees (git grep -F --untracked, bounded);
  • ~/.aidevops/agents/custom/;
  • local aidevops JSON configs such as site-inventory.json credential_env;
  • LaunchAgents plists and crontab -l.
• Detect dynamic construction (a provider prefix plus ${/string concatenation with a kind suffix on the same line). Report it as possible-dynamic, and set complete: false, so the result never claims "no dependents" when coverage is unproven.
• Output text or --json; local only, never posted.
• Delegate from .agents/scripts/secret-helper.sh.

Files Scope

• .agents/scripts/credential_inventory_dependents.py
• .agents/scripts/credential_inventory.py
• .agents/scripts/secret-helper.sh
• .agents/tools/credentials/credential-inventory.md

Acceptance Criteria

• aidevops secret dependents NAME --json lists literal matches (repo, path, line) across registered repos and worktrees, including alias matches.
• A line building the name dynamically (e.g. "CLOUDFLARE_${ACCOUNT}_API_TOKEN") is reported as possible-dynamic with complete: false; the result never states that the name is unused when such lines exist.
• The command reads no secret values and makes no network calls.

Verification

Run the product path against temporary repos containing literal and dynamic references; python3 -m py_compile; shellcheck.

Parent: #34680

Brief Workflow

This issue body is composed under .agents/workflows/brief.md. Newly queued auto-dispatch work must pass its Dispatch Readiness Contract (brief schema v2): complete write surface, hazards and compatibility, executable verification mapped to affected surfaces, and positive plus negative/regression acceptance criteria.