What Problem This Solves

Follow-up to #102009 / #102008. The first SecretRef egress implementation kept every resolved plaintext credential in unbounded process-lifetime sentinel maps, while debug proxy capture could persist registered credentials when they appeared outside sensitive headers (URLs, payloads, errors, metadata, and content types).

Closes #102388.

Why This Change Was Made

• Replace the plaintext sentinel registries with authenticated, process-local AES-256-GCM sealed sentinels while preserving stable value-and-label identity.
• Keep egress swapping format-independent through the shared sentinel detector.
• Redact registered raw, URL-encoded, and JSON-escaped secret forms before capture persistence.
• Fail closed for opaque binary capture payloads once a registered secret exists.
• Cover HTTP, WebSocket, tamper, serialization, binary, and Response-like capture paths.

User Impact

SecretRef-backed provider credentials still resolve only at the final egress boundary, but long-running processes no longer accumulate plaintext sentinel history. Debug capture no longer writes registered credentials when they occur in captured URLs, bodies, errors, metadata, or content-type fields.

Evidence

• Blacksmith Testbox tbx_01kx2ekbaa1za8trkptk1skd4q: 235 focused tests passed across proxy capture, logging redaction, sentinels, and provider egress.
• Scoped check:changed passed core/core-tests typechecks, lint, import-cycle checks, and architecture guards.
• Live Google Gemini egress proof returned HTTP 200 with the exact expected assistant marker; two capture events were persisted, and an exact-byte scan of every file in the isolated state directory found zero credential occurrences: https://crabbox.openclaw.ai/portal/runs/run_6d45df494e7c
• Fresh autoreview: no accepted/actionable findings.