Remove control credentials before invoking unrelated subprocesses

A release orchestrator should not leave admission, lifecycle, or edge-auth credentials in its ambient environment while invoking unrelated tools. Copy required values into the narrow in-process client, remove them from the process environment, and pass an explicitly sanitized environment to every Git, Kubernetes, migration, and package-management subprocess. Keep only the credentials each child actually needs. Step-level secret scoping alone is insufficient because all descendants inherit environment variables by default. This reduces blast radius but does not protect secrets already exposed in logs or compromised parent memory.

Applies when: CI release scripts call several external CLIs after loading control-plane secrets. Keywords: CI secrets subprocess environment inheritance kubectl GitHub Actions release credential isolation