Mirror ops-warden CredentialRouting canon in AGENTS.md and add the Claude Code rule at .claude/rules/credential-routing.md.