Insert DevOps Secrets Management Canon v1.0 unchanged, with a placement preface that keeps shared roots upstream. Publish it on the federation card. Assistant: grok Assistant-Session: 01a12ce1-7ded-7e03-a845-2ece8a573af4