docs: add secrets and credentials policy to AGENTS.md

Add an explicit, top-of-file policy forbidding any secret, password,
token, API key, or SSH key from being committed to the repository in
any form (source, comments, examples, docs, commit messages).

Covers: environment-variable/vault sourcing, placeholder usage in
examples, pre-commit self-check, and the mandatory history-purge
procedure (git filter-repo --replace-text + force-push + credential
rotation) if a secret is ever introduced.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

AGENTS.md

@@ -1,5 +1,25 @@
 # Agent Guidelines
 
+## Secrets and Credentials Policy
+
+**NEVER commit secrets, passwords, tokens, API keys, SSH keys, or any
+credential to this repository — in source, in comments, in examples, in
+documentation, or in commit messages. No exceptions.**
+
+Rules:
+1. **No secrets in code.** Credentials must come from environment variables,
+   a vault, or Ansible Vault — never from a hardcoded literal.
+2. **No real secrets in examples/docs.** Use placeholders like `$AWX_PASSWORD`,
+   `***REMOVED***`, or `<your-token-here>`.
+3. **Check before committing.** If a change introduces anything that looks like
+   a secret (password assignment, `b64encode`, `AUTH =`, API key, private key
+   block), stop and refactor it to read from the environment first.
+4. **If a secret is ever introduced**, it must be purged from the entire git
+   history (not just the working tree) with `git filter-repo --replace-text`,
+   followed by a force-push. Rotating the exposed credential is mandatory.
+5. **`.gitignore`** must keep secret-bearing paths ignored (e.g. `.env`, private
+   keys). Add new entries as needed.
+
 ## Git Commit and Push Policy
 
 **ALWAYS commit and push automatically. NEVER wait to be asked.**
@@ -56,3 +76,4 @@ Assisted-by: GLM-5 via Crush <crush@charm.land>
 - **Commit immediately after each logical unit of work.**
 - **Push after every commit.**
 - **Prefer many small, focused commits over fewer large ones.**
+- **Never commit secrets** — see the Secrets and Credentials Policy above.