Use secret-backed agent builder runtime

deploy/20-deployment.yaml

@@ -39,7 +39,8 @@ spec:
             - name: A2A_LITELLM_URL
               value: http://litellm.llm.svc.cluster.local:4000
             - name: A2A_LITELLM_KEY
-              value: sk-microcash-local
+              valueFrom:
+                secretKeyRef: {name: litellm-credentials, key: api_key}
             - name: A2A_LITELLM_MODEL
               value: gpt-5.5
             - name: A2A_CP_URL
@@ -47,9 +48,14 @@ spec:
             - name: A2A_MINIO_ENDPOINT
               value: http://microcash-infra-minio.microcash-infra.svc.cluster.local:9000
             - name: A2A_MINIO_ACCESS_KEY
-              value: minioadmin
+              valueFrom:
+                secretKeyRef: {name: minio-credentials, key: access_key}
             - name: A2A_MINIO_SECRET_KEY
-              value: minioadmin
+              valueFrom:
+                secretKeyRef: {name: minio-credentials, key: secret_key}
+            - name: A2A_SANDBOX_TOKEN
+              valueFrom:
+                secretKeyRef: {name: sandbox-auth, key: token}
           readinessProbe:
             httpGet: {path: /healthz, port: 8000}
             initialDelaySeconds: 8