Credentials arrive only from BW_* process env or an env file parsed in
pure Go (never sourced, never exec'd); files looser than 0600 are refused
before a single byte is read, and errors carry line numbers and key
names, never values. Env wins over file, per the porting-notes
precedence.
