Manager needs a platform-owned secret handoff path so resource bindings can keep only vault references while OpenBao stores tenant-scoped credential payloads. Tested: go test ./controller ./model ./router && go vet ./controller ./model ./router Co-authored-by: OmX <omx@oh-my-codex.dev>