Prefer T3 credential prompts when available

AGENTS.md

@@ -22,6 +22,16 @@ change's documentation disposition and the evidence behind its merge; commands
 presented as runnable must be ready to run as written. See
 `docs/agents/standards.md`.
 
+### Credentials
+
+When T3 Code's `request_secret` tool is available, call it whenever an
+authorized task needs a sudo password or other credential from the user.
+Use it instead of asking the user to paste secrets, copy sudo commands,
+or enter credentials in a terminal. For shell commands use `delivery: "file"`
+and read the private file inside the command; for supported T3 tools pass
+`secretRef`. Keep secret values out of output and execute the authorized
+operation yourself. Pass this rule to delegated agents.
+
 ### Focused checks
 
 `python3 -m unittest discover -s tests -v`