AGENTS.md, CLAUDE.md, dependencies: the shared crate is bxcore

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -96,14 +96,15 @@ Separate binaries in one Cargo workspace. Each role holds as little authority as
   `!approve`/`!deny` replies over the WebSocket.
 - `inferproxy` is a ~100-line byte forwarder from a Unix socket to the shared `llama-server`
   router on the host. It is required, because `loopd` has no network.
-- `proto` holds shared types. `toolkit` holds tool container entrypoints.
+- `bxcore` (formerly `proto`) holds shared types, and from M5b the secret store and the
+  sanitizer. `toolkit` holds tool container entrypoints.
 
 Structural rules that span crates:
 
-- No crate depends on another role's crate. Crates depend only on `proto`.
+- No crate depends on another role's crate. Crates depend only on `bxcore`.
 - Authority is encoded in types. A tool can't run without a `Decision`. It is defined in
   `brokerd` with a private field and no `Deserialize`, so only the policy module can construct
-  one (covered by a compile-fail test). `proto` carries a plain `DecisionRecord`.
+  one (covered by a compile-fail test). `bxcore` carries a plain `DecisionRecord`.
 - No source file over 500 lines.
 - Files are the source of truth (`sessions/`, `memory/`, `grants/`, `audit/`). SQLite is only
   for rebuildable indexes and queues.