fix(secrets): CHIT bypass patterns + project-local secrets path

[POWERFULMOVES]

Summary

• Register secrets pipeline tools (secrets_local_hydrate, bootstrap_env, brand_defaults, check_tier_envs, auth_alignment_check) in CHIT damage-control bypass patterns
• Switch sync-secrets-local GHA workflow to write secrets to project-local pmoves/secrets/ dir (reproducible across users/runners)
• Update secrets_local_hydrate.py to search project-local path first, then fall back to per-user APPDATA/XDG config

Cherry-picked from stash/damage-control-patterns stash branch (unique patterns only — rest already merged via PRs #1045-#1047).

Test plan

• make -C pmoves secrets-funnel completes without CHIT bypass blocks
• python pmoves/tools/secrets_local_hydrate.py --dry-run resolves correct path
• GHA sync-secrets-local workflow writes to pmoves/secrets/local.env

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Rate limit exceeded

@POWERFULMOVES has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 10 minutes and 44 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e85e4f04-a62e-4b28-afbe-e1bff975ee92

📥 Commits

Reviewing files that changed from the base of the PR and between a85b2ff and 4d92683.

📒 Files selected for processing (3)

• .claude/hooks/damage-control/patterns.yaml
• .github/workflows/sync-secrets-local.yml
• pmoves/tools/secrets_local_hydrate.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/damage-control-secrets-bypass

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}