Keep values in Windows Credential Manager, require a project bearer for single-value reads, and preserve existing non-secret MCP behavior. Feature-Confirmed: true Rules-Applied: R01,R03,R05,R06,R07,R10,R12,R13