Plant the Canary Before You Spend a Free Model Call

Developers must secure credentials by scanning fixtures locally before initiating free model calls to avoid leaking sensitive data like cloud keys. To ensure reproducibility, the tool host should be pinned before spending tokens. An agent run is only valid if both the model call and tool host are disposable and independent of a personal shell. Runs relying on specific machine states should be discarded and excluded from pull requests or contest writeups to maintain technical integrity.