Something has to be the first credential

Names the secret-zero problem, resolves it with platform-vouched identity via OIDC, and generalizes to multi-pipeline secret governance.