docs(rules): Heidenhain credential namespace note (#803 review)

.claude/rules/drivers.md

@@ -305,7 +305,10 @@ host logger factory (wired in `DriverFactoryBootstrap`; the FOCAS and TwinCAT fa
   `Lsv2ReadOnlyPolicy` (payload-checked in `Lsv2Codec.Frame`, the only frame builder; logins + R_VR/R_PR/R_RI/R_MB/R_DP
   only). Never widen the allowlist to work around a controller refusal. Init opens nothing (acquisition starts on the
   first subscribe/read); reads are cache-only; a refusal/denial/decode error is per-tag quality and does NOT degrade
-  health — only a down session does (with `LastSuccessfulRead` frozen). Passwords are `secret:`/`env:` refs only
+  health — only a down session does (with `LastSuccessfulRead` frozen). Passwords are NAMESPACED refs only —
+  `secret:heidenhain/…` / `env:OTOPCUA_HEIDENHAIN_…`, enforced at parse, resolve, save path, probe and deploy (an
+  unscoped ref let Test Connect exfiltrate any node secret in cleartext A_LG); a bad optional DNC/DATA credential is
+  `BadConfigurationError` on that role's reads only
   (`HeidenhainCredentialPersisted`). Hardware-unproven: the in-process simulator + Java golden vectors are the evidence;
   `Category=LiveIntegration` (`HEIDENHAIN_LSV2_HOST`) is the commissioning gate. `docs/drivers/Heidenhain.md`.
 - **Native condition state survives a full rebuild (#641):** `RebuildAddressSpace` captures each NATIVE condition's