docs(agents): add credential safety guardrail

.gitconfig

@@ -1,13 +1,20 @@
+# This is Git's per-user configuration file.
 [user]
-	name = Kishorekumar Neelamegam
-	email = nkishore@megam.io
-[core]
-	excludesfile = /home/kishore.gitignore_global
-[push]
-	default = simple
-[http]
-	postBuffer = 524288000
-[color]
-	ui = true
-[url "git://git.debian.org/d-i/"]
-	insteadOf = git+ssh://git.debian.org/git/d-i/
+	name = Kishore Kumar
+	email = kishore.kumar@e2enetworks.com
+
+[alias]
+    mr = !sh -c 'git fetch $1 merge-requests/$2/head:mr-$1-$2 && git checkout mr-$1-$2' -
+
+# Override author email for usezombie and personal repos
+[includeIf "hasconfig:remote.*.url:git@github.com:usezombie/**"]
+    path = ~/.gitconfig-usezombie
+
+[includeIf "hasconfig:remote.*.url:git@github.com:indykish/**"]
+    path = ~/.gitconfig-usezombie
+
+[includeIf "hasconfig:remote.*.url:https://github.com/usezombie/**"]
+    path = ~/.gitconfig-usezombie
+
+[includeIf "hasconfig:remote.*.url:https://github.com/indykish/**"]
+    path = ~/.gitconfig-usezombie

.gitconfig-usezombie

@@ -0,0 +1,2 @@
+[user]
+	email = nkishore@megam.io

AGENTS.md

@@ -423,6 +423,8 @@ Exit criteria:
 - No branch mutation outside lifecycle transitions.
 - No cross-worktree edits.
 - No secrets in commits/docs.
+- Never resolve or print credential values in conversation, code, docs, playbooks, or evidence files. This includes values seen in CI logs, error messages, or debug output — once seen, do not copy them anywhere. Check effects (health endpoints, connectivity status), not raw secrets. Use `op://` references and vault item names only.
+- When writing verification steps that reference credentials, always use `op read 'op://...'` at runtime. Never paste a literal value, even as an "example" or "old value to test against."
 - Prefer CLI and text artifacts. Do not require GUI-only tooling when a CLI path exists.
 
 ## Cognitive Discipline