Sweep agent secret exposure from prompt logs, tool configs, environment scope, repo traces, and rotation status