Owner-level, fail-closed switch to stop a normal source shipping secrets-bus data (like --skip-dbsc-suspect) #151

Hi Matt, thanks for agentcookie, and for teammate pull mode in v1.3.0.

Request: an owner-level, fail-closed switch that stops a normal (non-CDP) source from loading and shipping secrets-bus data. It would take the same shape as --skip-dbsc-suspect, for example --skip-secrets / AGENTCOOKIE_SKIP_SECRETS=1.

Why

Some owners keep every CLI token and API key in a password manager and give agents access only through it. For them the cookie sync is wanted and the secrets bus is not. Today, in a normal source:

• pushOnce calls loadSecretsPayload(home) whenever cdp_source is off (internal/cli/source.go L654-655). It attaches the result to the envelope (L749-751).
• The same envelope is cached for GET /pull (L757). With teammates, every paired agent receives it, not only a sink the owner set up by hand.
• Discovery is fail-open. It registers manifests from ~/.agentcookie/manifests, ~/.config/agentcookie/manifests, the system path, the extra paths, the Printing Press library adapter and the legacy ~/.agentcookie/secrets root (internal/secretsbus/discovery.go L73-100).
• A manifest's [sync] default is true when omitted (internal/secretsbus/secretsbus.go, parseManifest / applySyncPolicy). Non-optional [[files]] items are carried without opt-in (internal/secretsbus/filecarriage.go L86).

Per-manifest [sync] keys and the optional-file opt-in are useful, but whoever writes each manifest controls them. An owner can't say "never ship secrets from this source", and a CLI installed later starts shipping on the next push.

The only cookie-only route today is cdp_source (source.go L48-50, L181, L249). It needs a second Chrome that is always running with a debug port.

Suggested shape

• Add --skip-secrets / AGENTCOOKIE_SKIP_SECRETS=1 on source, following --skip-dbsc-suspect. Use a flag and an env var rather than a source.yaml key because of TestSourceConfigYAMLKeysUnchangedForOlderBinaries. That test is why feat(source): add --skip-local-storage to stop shipping Local Storage #150 took the same route.
• When the switch is set, skip loadSecretsPayload entirely, so manifests and carried files are not read at all, as well as not sent.
• Have agentcookie doctor report that secrets are skipped, so an owner can confirm it without reading the envelope.

Together with #150 (--skip-local-storage), this would give a normal source a cookie-only mode equivalent to cdp_source, without the second Chrome. Related: #149.

(Prepared with my AI agent. The code references were checked against main at 36e7f99.)