Migrate Notarius to credential lists

docs/config.md

@@ -230,7 +230,7 @@ inputs:
 - Do not place raw secrets in YAML.
 - Credential fields contain environment-variable names, represented internally
   as ConfigKit typed secret references (for example
-  `pipeline.notarius.llm_api_key: NOTARIUS_LLM_API_KEY`). A configured reference
+  `pipeline.notarius.credentials: [NOTARIUS_LLM_API_KEY]`). A configured reference
   must resolve to a nonempty environment value during load.
 - Every surviving reference is resolved during ordinary pipeline loading,
   regardless of whether its integration is disabled, outside the selected
@@ -362,7 +362,7 @@ Rules:
 | `pipeline.trim.seriatim.report` | bool | No | `false` |
 | `pipeline.notarius.enabled` | bool | No | `false` |
 | `pipeline.notarius.binary` | string | No | `notarius` |
-| `pipeline.notarius.llm_api_key` | secret reference | No | unset; exact environment-variable name forwarded to Notarius |
+| `pipeline.notarius.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Notarius |
 | `pipeline.notarius.config_profile` | string | No | unset; exact Notarius ConfigKit profile selector |
 | `pipeline.notarius.config_path` | string | Conditional | required when enabled; relative paths resolve from the pipeline file directory |
 | `pipeline.notarius.pipeline_id` | string | Conditional | required when enabled |
@@ -406,35 +406,36 @@ does not restrict profile names, resolve profile files, or rewrite the value.
 This selection is independent of Narratio's own `--overlay` selection. A
 Narratio overlay may explicitly select a differently named Notarius overlay,
 but Narratio never forwards its own overlay name automatically. It is also
-independent of `pipeline.notarius.llm_api_key`: an overlay may change either or
+independent of `pipeline.notarius.credentials`: an overlay may change either or
 both fields according to the deployed Notarius configuration. See the
 [Notarius integration contract](./integrations/notarius.md) for invocation and
 failure behavior.
 
-### Notarius Credential
+### Notarius Credentials
 
-`pipeline.notarius.llm_api_key` optionally names the one environment variable
+`pipeline.notarius.credentials` optionally lists environment-variable names
 to forward to the Notarius child process:
 
 ```yaml
 notarius:
-  llm_api_key: OPENROUTER_API_KEY
+  credentials: [OPENROUTER_API_KEY, ANTHROPIC_API_KEY]
 ```
 
-The field contains the variable name, not a credential value. That name must
-match `api_key_env` in the Notarius/PromptKit profile selected by the deployed
-Notarius pipeline; Narratio does not infer or remap provider names. Omission or
-`null` forwards nothing. A non-null selected reference must resolve at pipeline
+The list contains variable names, not credential values. Those names must
+match the credential references in the selected Notarius/PromptKit configuration;
+Narratio does not infer or remap provider names. Omission, `null`, or `[]`
+forwards nothing. Each selected reference must resolve at pipeline
 load time through the process environment or existing secrets-directory
 bootstrap, even when Notarius is disabled, extract is outside the requested
 range, or a completed extraction can be reused.
 
 The Notarius child receives only Narratio's minimal execution environment plus
-this exact selected name and loaded value. Other credentials are not forwarded.
-Changing the value, name, presence, or absence does not invalidate extract's
-semantic resume evidence. The public name remains part of safe effective
-inspection, so renaming it may appear in `config diff` and change the effective
-configuration digest; rotating only its value does neither.
+these exact selected names and loaded values. Other credentials are not forwarded.
+Changing a value, name, presence, or absence does not invalidate extract's
+semantic resume evidence. The public names remain part of safe effective
+inspection, so renaming them may appear in `config diff` and change the effective
+configuration digest; rotating only their values does neither. An overlay
+replaces the whole list, including with `[]` to clear it.
 
 See the [Notarius integration contract](./integrations/notarius.md) for the
 delivery and redaction boundary.