feat(delivery): refuse to push a phase whose changes contain a server credential

Container-tier missions carry model-provider keys in their environment (Claude
Code needs its credential; the fallback chain needs GLM and Kimi), the agent
has Bash, and no gate rule mentioned them. Delivery is the one exit all work
passes through, so it now checks the outgoing diff and commit messages for the
EXACT values of every watched secret (verbatim or base64): on a hit the push is
refused with the key names recorded, the stored patch — served to the UI — is
redacted, and a delivery.secret_blocked event is written. Values never logged.

Exact matching, not shapes: text about keys is not flagged. A test pins the
watched list to a superset of what containers are given in both auth modes.
CLAWMATES_DELIVERY_CANARY (a random non-credential) lets the refusal be proven
live without a real key.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/cm-api/src/lib.rs

@@ -26,6 +26,7 @@ pub mod microvm_client;
 pub mod microvm_executor;
 pub mod microvm_turn_executor;
 pub mod continuous_research;
+pub mod delivery_secrets;
 pub mod mission_delivery;
 pub mod podcast;
 pub mod mission_events;