Use secrets in conversations

[nishu-builder]

Summary

• load the git-ignored, per-device .caos-secrets store for TUI, talk, and chat conversation work
• bind an explicit base-url into every llm-step and llm-call ArgTree
• pin production Anthropic readers to https://api.anthropic.com and test readers to their exact local stub URL
• carry secret values out of band and inject anthropic-api-key only into matching LLM workers
• preserve already-authorized grants across detached run-async work, including durable subagent conversations
• share secret-file parsing and non-streaming request execution between conversation paths

Dependency

This PR is stacked on #121, which introduces the generic constrained reader= grammar. The reader parser, assembler, generic authorization behavior, and generic security tests live there; this PR only applies that facility to conversations and LLM credential destinations.

Configuration

# .gitignore
.caos-secrets/

# .caos-secrets/anthropic-api-key
name=anthropic-api-key
value:@=/absolute/path/to/anthropic-api-key
reader=--base:@=DEEP-DEPS/llm-step --base-url=https://api.anthropic.com
reader=--base:@=DEEP-DEPS/llm-call --base-url=https://api.anthropic.com

caos-cli secrets adds the random entropy= used for cache isolation. A custom endpoint remains supported when local policy pins that exact URL.

Security boundary

Conversation requests carry both the entropy-derived secret-hash and an explicit base-url; they never carry the API-key value. llm-step and llm-call require the URL from their ArgTrees instead of relying on a runtime default absent from the authorization key.

The raw secret value does not enter an ArgTree, cache key, curry, worker image, or Git object. The server sees it only in ephemeral run context and injects it into an entitled worker at runtime.

Validation

• cargo fmt --all -- --check
• cargo test --workspace
• nix build
• fresh salted result/bin/caos-cli run-tool test (44/44 passed)
• shell syntax and reader-fixture migration checks
• git diff --check