james.maesandClaude Opus 5.5
2b5a84e805
SessionCredentialsClient is gone: the session token now rides core
S3BackendMetaData.sessionToken, and the presigner takes its credentials from
core S3ClientFactory.buildCredentialsProvider. SecretRefs keeps only the
qbit's allow-list; ${file.PATH} resolution is core QMetaDataVariableInterpreter
(read-only, allowed roots /var/run/secrets and /run/secrets by default).
Tests point qqq.fileReference.roots at their temp dirs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>