[andretodman]

Summary

• add encrypted GX10-managed service-key records with immutable normal controls
• require normal API auth plus connector-derived constant-time host proof
• enforce watched-only use and 90-second leases
• preserve manual keys and fail closed on collisions or expired reconciliation
• include managed values in existing live redaction without exposing source identity

Verification

• service-key core: 101 assertions
• environment contract: 41 assertions
• connectors UI: 156 assertions
• host reconciliation: 50 assertions
• secret redaction: 11 assertions
• syntax and website mirror checks pass

Companion changes: andretodman/PubfuseRestApi#545 and andretodman/pubfuse_local_ai#1.

[andretodman]

Closing because Pubfuse does not control this upstream repository. The integration has moved to the Pubfuse-controlled fork and was merged in andretodman#1. Upstream remains read-only reference context; no upstream merge is required for the Factory runtime.