D36 第0步：範例 workflow 金鑰統一走 credential（止血——範例是用戶照抄的樣板）

改前四種寫法並存、沒一個是 credential，而執行端只認 {{credential.X}}
（graph-executor.ts:247→resolveCredentialRefs）⇒ 用戶照抄必踩坑：
  {{api_key}} 13／{{gitea_token}} 2／{{secret.GITHUB_BOT_TOKEN}} 2／{{kbdb_api_key}} 1

改後（19 處統一）：
  {{credential.arcrun_namespace}} 15／{{credential.gitea_token}} 2／{{credential.github_bot_token}} 2

⚠️ 中途修正一次錯誤命名：我先改成 kbdb_partner_key（照零件契約舊敘述 ak_xxx），
leo 當場指正「現在沒有 partner key，改用 namespace，沒有發 API key 的機制」——
實際機制確為 X-Arcrun-API-Key: <namespace>（實例上活的 workflow 為證）。

不動：{{secret.LEO_TELEGRAM_CHAT_ID}} 3 處——chat_id 是聊天室 ID 不是金鑰，
無腦套規則會引進「找不到 credential」的錯誤。

驗：違規寫法歸零／12 個範例 YAML 全可解析。
殘：kbdb_upsert_block 契約仍寫『KBDB partner key（ak_xxx）』＝假資訊源（我就是被它騙的），
修它被 component-guard 擋（正確），需 leo 跑 scripts/component-arm.sh。

registry/examples/cron-watcher/workflow.yaml

@@ -14,7 +14,7 @@ config:
 
   list_unprocessed:
     component: kbdb_get
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     type: "note"
     source: "user-input"
     limit: 20
@@ -32,7 +32,7 @@ config:
   trigger_processor:
     component: trigger_workflow
     workflow_name: "your_processor_workflow"   # ← 改成你的處理 workflow 名
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     input:
-      api_key: "{{api_key}}"
+      api_key: "{{credential.arcrun_namespace}}"
       block_id: "{{item.id}}"

registry/examples/daily-digest/workflow.yaml

@@ -17,7 +17,7 @@ config:
 
   fetch_kbdb_yesterday:
     component: kbdb_get
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     type: "note"
     source: "km-writer-direct"
     limit: 50

registry/examples/github-issue-bot/workflow.yaml

@@ -33,7 +33,7 @@ config:
     url: "https://api.github.com/repos/{{input.repository.full_name}}/issues/{{input.issue.number}}/comments"
     method: POST
     headers:
-      Authorization: "Bearer {{secret.GITHUB_BOT_TOKEN}}"
+      Authorization: "Bearer {{credential.github_bot_token}}"
       Accept: "application/vnd.github+json"
     body_json:
       body: "{{analyze.first_response}}"
@@ -43,7 +43,7 @@ config:
     url: "https://api.github.com/repos/{{input.repository.full_name}}/issues/{{input.issue.number}}/labels"
     method: POST
     headers:
-      Authorization: "Bearer {{secret.GITHUB_BOT_TOKEN}}"
+      Authorization: "Bearer {{credential.github_bot_token}}"
     body_json:
       labels:
         - "auto-triaged"

registry/examples/km-wiki-ingest/workflow.yaml

@@ -36,7 +36,7 @@ config:
     method: GET
     url: "https://git.uncle6.me/api/v1/repos/{{repo}}/contents/system-dev/wiki/cards?ref={{ref}}"
     headers:
-      Authorization: "token {{gitea_token}}"
+      Authorization: "token {{credential.gitea_token}}"
       Accept: "application/json"
     # 下游用 filter/set 取「游標之後第一張、且 .md、且非 00-INDEX」的一張。
 
@@ -46,7 +46,7 @@ config:
     method: GET
     url: "{{pick_next_card.next.download_url}}"
     headers:
-      Authorization: "token {{gitea_token}}"
+      Authorization: "token {{credential.gitea_token}}"
 
   # 4) ★ 機械解析 —— 通用 code 零件（sandbox inline JS，無 LLM、無 fs/網路，stdin→stdout JSON）。
   #    Arcrun#10 裁定：一次性解析邏輯走通用逃生口，不再鑄 domain 零件 km_wiki_card_parse。
@@ -414,7 +414,7 @@ config:
   #    metadata.embed=true → base embed 模組會補嵌 → 語意可搜。
   upsert_entry:
     component: kbdb_upsert_block
-    api_key: "{{kbdb_api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     kbdb_url: "{{kbdb_url}}"
     page_name: "{{parse_card.data.entry.page_name}}"
     type: "{{parse_card.data.entry.entry_type}}"
@@ -438,7 +438,7 @@ config:
     url: "{{graph_url}}/triplets/ingest"
     headers:
       Content-Type: "application/json"
-      X-Arcrun-API-Key: "{{graph_api_key}}"
+      X-Arcrun-API-Key: "{{credential.arcrun_namespace}}"
     body_json: "{{envelope}}"      # envelope 已符合 ingest-candidate.json 契約（禁止欄位已排除）
 
 # ── 執行環境變數（部署時注入；此檔不放密鑰）──

registry/examples/llm-classify/workflow.yaml

@@ -24,7 +24,7 @@ config:
 
   save_with_tag:
     component: kbdb_create_block
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     type: "note"
     source: "llm-classified"
     user_id: "ai_classifier"

registry/examples/parallel-fanout/workflow.yaml

@@ -12,24 +12,24 @@ config:
   dispatch_to_summary:
     component: trigger_workflow
     workflow_name: "llm_classify_example"   # 改成你的 summary workflow
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     input:
-      api_key: "{{api_key}}"
+      api_key: "{{credential.arcrun_namespace}}"
       text: "{{input.text}}"
 
   dispatch_to_translate:
     component: trigger_workflow
     workflow_name: "your_translate_workflow"
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     input:
-      api_key: "{{api_key}}"
+      api_key: "{{credential.arcrun_namespace}}"
       text: "{{input.text}}"
       target_lang: "{{input.target_lang}}"
 
   dispatch_to_classify:
     component: trigger_workflow
     workflow_name: "llm_classify_example"
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     input:
-      api_key: "{{api_key}}"
+      api_key: "{{credential.arcrun_namespace}}"
       text: "{{input.text}}"

registry/examples/pdf-to-blocks/workflow.yaml

@@ -18,7 +18,7 @@ config:
   # source 用 file_url 當去重 key（同 PDF 重 ingest 不會重複建）
   ingest_to_kbdb:
     component: kbdb_ingest
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     page_name: "pdf-{{input.title}}"
     text: "{{convert_pdf.data.text}}"
     source: "pdf:{{input.pdf_url}}"

registry/examples/rag-search-answer/workflow.yaml

@@ -8,7 +8,7 @@ flow:
 config:
   search_kbdb:
     component: kbdb_search
-    api_key: "{{api_key}}"
+    api_key: "{{credential.arcrun_namespace}}"
     query: "{{input.question}}"
     topK: 5
     user_id: "{{input.user_id}}"   # 可選，限定某用戶 namespace