List Secrets

Discovery: list the caller's ACTIVE secrets as VALUE-FREE metadata (alias, context, created_at, concepts) so an agent can FIND a secret by alias WITHOUT ever seeing a value. The tenant comes from the VERIFIED claims and scopes the query (org A can never enumerate org B's secrets). A secret-atom with no reachable secret:{alias} external_ref (e.g. stored directly, not via this route) is SKIPPED — its alias could not be used via the by-alias route anyway, so surfacing it would only mislead.

include_retired=true adds the retired ones (step 5, 2026-10-10): value-free history rows, told apart by the #retired- mark in their ref (server-controlled: no alias can spell #), whose alias is the name they had (metadata.retired_alias) and whose retired_at is set. Their stored value was overwritten and their ref is unreachable.