pub fn is_credential_key(key: &str) -> bool
OpenClaw’s own credential rule: the lower-cased key ENDS WITH a marker; only the name decides.