feat(ci-infra): refuse to start on a plaintext MCP credential on this box (#1287)