OneCLI – OSS credential gateway that keeps secrets out of AI agents