Session-protocol and related rules synced from state-hub template refresh.
Mirror ops-warden CredentialRouting canon in AGENTS.md and add the Claude Code rule at .claude/rules/credential-routing.md.