Jobs secrets belong to the key that stored them

A jobs secret stored by an API key can now be used only by that key, by agents you name, and by you. Share it with your other keys using runtime secrets share NAME --agent <id>, --all or --none (secrets.share in the SDKs, POST /v1/secrets/{id}:share). Secrets you store on the website stay every key's. A job that binds a secret another key stored stops at its next run until that key or you share it; if another of your keys could reach a secret before now, rotate it. A job created with a secret its key may not use is refused with secret_not_shared. See secrets in a job.