Prototype placeholder injection mode for agent secrets

[bglusman]

Summary

Prototype placeholder injection mode for off-the-shelf agents: spawn agents with per-agent placeholder credentials and substitute real secrets at the proxy boundary.

Initial scope

• Generate per-agent placeholder values for configured secrets at spawn time.
• Register placeholder-to-secret mappings in security-proxy.
• Recognize placeholder shapes in outbound headers/bodies and substitute through existing secret substitution paths.
• Document lifecycle, destination allowlist behavior, and bypass limits.

Reference

• docs/roadmap/placeholder-injection-mode.md