3b of the centralization. All 5 secretKeyRefs now reference researchowl-secrets-infisical (synced from /researchowl). Also adds strategy: Recreate (single-replica RWO SQLite/WAL — avoids two pods briefly sharing /data/researchowl.db during a roll), permanent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>