Forward Scriptorium credentials through the shared adapter path

docs/integrations/scriptorium.md

@@ -21,7 +21,7 @@ Both request types carry:
 - output path;
 - timeout;
 - generated config + stdout/stderr log paths;
-- optional API-key env var name;
+- optional list of already-resolved credential references;
 - optional working directory.
 
 ## Result Contract
@@ -39,7 +39,16 @@ Request validation fails for:
 - non-positive timeout;
 - empty input/var names;
 - empty input path values;
-- missing required credential env var when `APIKeyEnv` is set.
+- unresolved or empty selected credential references.
+
+Both modes use the shared credential forwarding used by Audita and Notarius:
+selected names and captured values augment the minimal child environment, and
+all selected values are registered for captured-stream redaction. The adapter
+does not reread the parent environment or override Scriptorium's provider
+selection with `--api-key-env`. Generated invocation records and result metadata
+contain `credential_env_names`, never credential values. This does not scan or
+redact files written directly by Scriptorium. Selection semantics belong in
+[Scriptorium credentials](../config.md#scriptorium-credentials).
 
 Run behavior:
 - subprocess errors propagate with context;