BM-3003: refactor(ops-skills): migrate credentials to Bitwarden CLI

[jonastheis]

Summary

Replace the gitignored network_secrets.toml with the Bitwarden CLI as the single source of truth for credentials used by the ops-query umbrella skill and its four sub-skills (ops-indexer-query, ops-telemetry-query, ops-logs-query, ops-pipelines).

Why:

• No plaintext secrets on disk.
• Rotations propagate automatically (next bw sync picks up the new value).
• A leaked laptop = one revoked Bitwarden session, not 18 keys to rotate everywhere.
• Per-credential access control and audit already exist in Bitwarden — we get sharing for free via a shared organization/collection.

Changes

New files (under .claude/skills/ops-query/references/)

• bw-credentials.sh — sourced bash helpers: bw_ensure_ready, bw_load_aws, bw_load_indexer, bw_load_redshift_url. All lookups go through bw_get_by_name (exact-name match via bw list items --search + jq), working around bw's fuzzy bw get item matching where e.g. prod_base also matches prod_base_sepolia.
• bw-credentials.md — install (npm-pinned to 2026.2.0), per-shell unlock, bootstrap (one-time team seed + shared vault), troubleshooting, and a Known Issues section flagging the v2026.3.0/4.1 regression that breaks non-interactive bw use (bitwarden/clients#20703).
• bw-migrate-from-toml.sh — idempotent one-shot migration. Reads network_secrets.toml, creates 17 items (8 indexer + 6 telemetry + 3 AWS). The 18th item boundless-ops-aws-ops is added to the shared collection separately by an admin from runbook credentials.

SKILL.md updates — each credential-loading step collapses to the same pattern:

```bash
source .claude/skills/ops-query/references/bw-credentials.sh
bw_ensure_ready || exit 1
bw_load_aws prod # or bw_load_indexer prod_base, bw_load_redshift_url prod_base, etc.
```

Plaintext TOML fallback paths are removed entirely — the skills fail loud with install/unlock instructions if bw is missing or locked.

Bitwarden item schema (18 items)

Group	Count	Name pattern	Fields
AWS	4	boundless-ops-aws-<prod|staging|dev|ops>	username = access key id, password = secret
Indexer	8	boundless-ops-indexer-<env>	password = API key (+ chain, environment text fields)
Telemetry	6	boundless-ops-telemetry-<env>	username = readonly, password, + db_url / chain / environment

Rollout

1. One team member runs bash .claude/skills/ops-query/references/bw-migrate-from-toml.sh against their local TOML and moves the resulting items into the shared Boundless Ops collection (or equivalent).
2. Admin adds boundless-ops-aws-ops to the same collection.
3. Everyone else just needs collection access — bw sync makes the items appear locally.

Out of scope

ops-check-balances still references network_secrets.toml for QuikNode private RPC keys ([networks.<chain>.rpc]). Those blocks don't exist in the current TOML; tracked as a follow-up.

Test plan

• bw_load_aws prod && aws sts get-caller-identity returns the prod account
• bw_load_aws ops && aws codepipeline list-pipelines works
• bw_load_indexer prod_base && curl -H "x-api-key: $INDEXER_API_KEY" "$MARKET_INDEXER_URL/v1/market/requests?limit=1" returns data
• bw_load_redshift_url prod_base && psql "$REDSHIFT_URL" -c 'SELECT 1' returns one row
• With vault locked, bw_ensure_ready exits non-zero and prints the unlock instructions
• Run one pre-built investigation (e.g. market-summary on prod_base) end-to-end with no network_secrets.toml reads

[linear]

BM-3003