feat(skills): add safe Bitwarden Secrets Manager workflow

[prandelicious]

Intent

Create bws Bitwarden Secrets Manager CLI skill with dual firstmate/project loading via skills/bws owner and .agents/skills/bws stub, bws-safe helper, tests, doc checks; open PR to kunchenguid/firstmate, do not merge.

What Changed

• Add a public Bitwarden Secrets Manager CLI skill and a Firstmate agent-only stub that routes to the shared procedure.
• Add a safe helper for authentication probing, JSON redaction, metadata listing, and unambiguous secret ID resolution.
• Document the dual-surface skill layout and add fixture-based coverage for redaction, authentication states, duplicate keys, and CLI failure handling.

Risk Assessment

✅ Low: The change is well-bounded, satisfies the dual-loading and safe-helper intent, and the behavior-oriented tests cover the material authentication, redaction, resolution, and failure-classification paths without introducing source-content-only assertions.

Testing

Focused behavior and documentation tests passed, and a reviewer-visible CLI transcript demonstrates the helper’s public commands, safe unavailable-state probe, and value/note redaction; no screenshot was captured because this change has no rendered UI.

Evidence: Sanitized bws-safe end-user CLI transcript

Source: Sanitized bws-safe end-user CLI transcript

$ skills/bws/scripts/bws-safe.sh --help
bws-safe.sh - safe helper for Bitwarden Secrets Manager CLI (bws)

Usage:
  bws-safe.sh probe
  bws-safe.sh redact-json
  bws-safe.sh list-metadata [PROJECT_ID]
  bws-safe.sh resolve-id <PROJECT_ID> <KEY>

Never prints access tokens or secret values.

$ env -u BWS_ACCESS_TOKEN -u BWS_PROFILE -u BWS_CONFIG_FILE HOME=/tmp/bws-evidence-empty-home PATH=/usr/bin:/bin skills/bws/scripts/bws-safe.sh probe
status=unavailable version=none token_present=no

$ printf <sample-secret-json> | skills/bws/scripts/bws-safe.sh redact-json
{
  "id": "secret-id",
  "key": "DATABASE_URL",
  "value": "[REDACTED]",
  "note": "[REDACTED]",
  "projectId": "project-id"
}

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• tests/bws-safe.test.sh
• tests/fm-documentation-audiences.test.sh
• skills/bws/scripts/bws-safe.sh --help
• Unauthenticated isolated-environment probe using skills/bws/scripts/bws-safe.sh probe
• Piped representative secret JSON through skills/bws/scripts/bws-safe.sh redact-json and captured the sanitized output

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.