t18701: aidevops secret organise: plan-first cleanup of inconsistent credentials without renames #34723

Task Brief

What

Add aidevops secret organise: a guided, plan-first path for an install whose credentials are already inconsistent. It drafts registry entries and aliases and shows dependents, but never renames or deletes anything. Phase 6 of #34680 (guarantees 8, 9).

Why

Cleaning up after the fact is risky: renames silently disable features, and some consumers can't be found by name. Operators therefore leave the mess in place and it grows.

How

• New .agents/scripts/credential_inventory_organise.py. It combines the names-only secret-helper.sh inventory, the registry and the verifier cache, and proposes:
  • draft records for undescribed secrets (provider inferred from a known prefix, confirmed: false, evidence noted);
  • account refs from the verified account names;
  • aliases rather than renames for duplicate or overlapping tokens;
  • a default decision per provider;
  • a dependents count per credential.
• --apply-drafts writes only confirmed: false draft metadata. It never changes secret values, never renames and never deletes.
• Output text or --json. Delegate from secret-helper.sh.

Files Scope

• .agents/scripts/credential_inventory_organise.py
• .agents/scripts/credential_inventory.py
• .agents/scripts/secret-helper.sh
• .agents/tools/credentials/credential-inventory.md

Acceptance Criteria

• On an install with undescribed Cloudflare secrets, aidevops secret organise --json lists a draft per secret, provider defaults to decide, and alias proposals for overlapping tokens.
• --apply-drafts adds only confirmed: false metadata; the stored secret names and values are byte-identical before and after.

Verification

Run the product path with a temporary HOME containing plaintext fallback credentials and a cache fixture, and compare the secret files before and after.

Parent: #34680

Brief Workflow

This issue body is composed under .agents/workflows/brief.md. Newly queued auto-dispatch work must pass its Dispatch Readiness Contract (brief schema v2): complete write surface, hazards and compatibility, executable verification mapped to affected surfaces, and positive plus negative/regression acceptance criteria.