ADR: gate consequential connector writes at the effect, not the command string

[brAperia2025]

An informal discussion ADR (per CONTRIBUTING).

SECURITY.md already documents two limitations — command policy is bypassable, and sandbox credentials are ambient while in use. This proposes closing both for the case that matters most, consequential external writes made by a connector, by gating the effect (the outbound write) rather than the command string that produces it:

1. Deliver consequential-write connectors through the credential broker instead of env vars, so the secret stays server-side and core sees the real method/path/body rather than a bare host.
2. Require an action-bound, single-use approval at the broker (hash the request; a human mints the token, the sandbox cannot). This also closes a smaller existing gap where a command approval binds to the matched regex pattern rather than the approved command.

Full write-up in the added adrs/ file. No code — happy to implement if the shape sounds right.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}