feat(governance): move the local MCP credential into SOPS and gate plaintext recurrence (#1256)