[AGE-4067] feat(agents): Inject custom secrets into agent runs

.agents/skills/agent-release-gate/SKILL.md

@@ -106,6 +106,45 @@ name the k. A commit-lock race test skipping for want of a reachable Postgres is
 one-line syntax error (`SET LOCAL lock_timeout` with a bind parameter, which Postgres rejects
 outright) survived 1911 green tests before a human hit it as his first live action.
 
+**The two journeys that run many things at once: `burst` and `crosstalk`.** Every other journey
+drives one run at a time, so the gate only ever saw faults that reproduce on a quiet deployment.
+The credential-delivery fault of AGE-4249 does not: about one production first message in five
+failed because some fresh Daytona sandboxes start without their Secret substitution wiring, and
+per cold sandbox that is roughly an 8 percent fault. `burst` sends 16 first messages at the same
+time on 16 brand new sessions, so the run buys 16 cold starts instead of one. `crosstalk` runs 3
+two-turn conversations with long output beside 2 approval flows, and checks that no stream carries
+another session's nonce, except on the codex harness, where the gate rides a platform tool with
+empty arguments, so the approval command carries no nonce and isolation is not checked there
+(`nonce_checked=false`). Both are Daytona-only by default and skip elsewhere; both report the
+runner's stable error code per run, so a `credential_delivery_failed` names itself.
+
+```bash
+uv run resources/qa_product.py --cell C4 --only burst --only crosstalk
+uv run resources/qa_product.py --cell C4 --only burst --burst-size 24         # more cold starts
+uv run resources/qa_product.py --cell C3 --only crosstalk --concurrency-everywhere  # local too
+uv run resources/test_qa_product_concurrency.py                               # offline tests
+```
+
+**Read a green burst honestly.** At an 8 percent per-cold-start fault rate, 8 runs miss the fault
+51 percent of the time, 16 miss it 26 percent, and two Daytona cells at 16 miss it about 7 percent.
+A PASS is a sample, not an all-clear, and the result says so in its own reason line. A FAIL is
+proof.
+
+Each concurrent run holds its own Daytona sandbox, about 5 GiB of the organization's disk, and a
+parked sandbox keeps counting until its auto-delete window closes, so a burst of 16 is about 80
+GiB in flight. The counts are `--burst-size` (default 16), `--crosstalk-conversations` (default 3)
+and `--crosstalk-approvals` (default 2). The cap is 32 concurrent runs: 32 for the burst size, and
+32 for the two crosstalk counts TOGETHER, because what costs disk is what runs at once. When the
+provider refuses on capacity the journey reports SKIP with a loud reason, never a PASS or a FAIL,
+because nothing about the product was measured. `--concurrency-timeout` (default 300s) bounds one
+TURN and rides into the stream as an absolute deadline, so a two-turn crosstalk run gets twice
+that and a stream that never ends is abandoned rather than followed.
+
+A release that changes `services/runner/src/engines/sandbox_agent/**` or
+`services/runner/src/providers/daytona*` makes the Daytona cells C2, C4 and X2 mandatory through
+`path_triggers.py`, and forces `burst` and `crosstalk` into the run even when `--only` named
+something else. That is how these journeys reach a release that needs them.
+
 **Before a human gets a deployment URL, run `resources/qa_commit_approval.py` too.** It is not
 part of `qa_product.py`'s cell × journey matrix — none of that matrix's journeys drive a live turn
 against a REAL, saved workflow revision (the `commit` journey only exercises the REST API; `chat`,
@@ -142,6 +181,62 @@ cell, promoted after the platform-guidance fix closed that exact gap; it reuses
 the same way the separate one-shot benchmark (Tier B) does — check there before writing a new
 mechanism-blind cell from scratch, to avoid duplicating scaffolding.
 
+## Session control cells
+
+`resources/session_control.py` is a second, standalone driver: sixteen cells that cover Stop,
+durable commands, and the runner's recovery paths (owner release, park/resume, watchdog
+quarantine). It drives the same product endpoint and asserts on the same wire, but it needs its
+own account bootstrap, so it runs as a separate process rather than as `qa_product.py` cells. See
+`resources/path_triggers.py` for the exact mandatory-cell mechanism.
+
+**These cells are MANDATORY** — run them, not just the standing gate — whenever the release diff
+touches any of:
+
+- `services/runner/src/sessions/**`
+- `services/runner/src/engines/sandbox_agent/**`
+- `api/oss/src/core/sessions/**`
+- `api/oss/src/tasks/asyncio/sessions/**`
+- `api/oss/src/apis/fastapi/sessions/**`
+
+Run every cell with one line:
+
+```bash
+uv run resources/session_control.py --cells all --harness pi_core --sandbox local
+```
+
+Add `--project <docker-compose project name>` to run the eight cells that need direct Docker and
+Postgres access (`sandbox-gone`, `records-outage`, `restart-after-stop`, `runner-gone`,
+`runner-gone-late`, `post-stop-row`, `codex-child`, `stale-tail`) and the abort-log subcheck inside
+`stop-after-finish`. Without `--project`, those eight cells SKIP with a named reason. The
+`stop-after-finish` HTTP check still runs, but only its abort-log subcheck is unavailable. The
+other eight cells
+(`stop-warm`, `double-send`, `stale-stop`, `stop-approval`, `stop-after-finish`,
+`repeat-stop`, `concurrent-stops`, `stop-during-completion`) run over HTTP alone against any
+deployment. Add
+`--resume <path to a prior run's results.json>` to pick a lost run back up: any cell already
+recorded there is loaded instead of re-run.
+
+Results land in a timestamped folder under `~/agenta-qa-evidence/` (override with
+`AGENTA_QA_RUNS_DIR`), as `results.json` and `summary.md` — the same PASS/FAIL/SKIP shape as the
+rest of the gate. When a release path makes session control mandatory, pass that artifact to the
+standing gate with `--session-control-results <path>`: a missing or incomplete artifact stops the
+gate before the matrix runs, and a recorded FAIL makes the final gate exit nonzero.
+
+**Environment, by name.** Same three-variable discipline as the rest of the gate, no env-file
+fallback:
+
+- `AGENTA_BASE` — the deployment origin.
+- `AGENTA_ADMIN_KEY` — mints the ephemeral account this driver runs under. Lives in
+  `~/.agenta-qa-secrets.env`.
+- `QA_OPENAI_API_KEY` — stocked into that account's vault so the `pi_core` and `codex` harnesses
+  have a provider key. Lives in `~/.agenta-qa-openai.env`.
+- `ANTHROPIC_API_KEY` — only required for `--harness claude`, stocked into the same vault the
+  same way. Lives in `~/.agenta-qa-secrets.env`. A pi_core- or codex-only run does not need it.
+
+A Daytona run additionally needs a Secrets-capable Daytona key on the runner; the key in most
+session env files returns 403 on the Secrets endpoint, so check that before trusting a Daytona
+result.
+
 ## When results lie
 
 The runtime **fails open**: a component can break, get logged, and the turn still succeeds with a