Scrub tracked secrets and switch ATVM docs to local credential references

- remove hardcoded credentials, tokens, registration codes, and similar secret values from tracked ATVM and CDS MCP docs
- replace those values with references to /home/aw/code/cds/.env.credentials.local and the corresponding environment variable names
- update current operator guides to instruct sourcing .env.credentials.local before credential-dependent setup and automation workflows
- update the ATVM setup scripts to consume ATVM_TARGET_PASSWORD from the environment instead of hardcoding the Ubuntu root SSH password
- scrub the remaining tracked artifact log entry that still included the old CMC registration code
- keep the local-only credential inventory in .env.credentials.local while leaving that file untracked

atvm/scripts/run-atvm-setup-and-collect-log.sh

@@ -2,9 +2,18 @@
 
 set -euo pipefail
 
+WORKSPACE_ROOT="${WORKSPACE_ROOT:-/home/aw/code/cds}"
+ENV_CREDENTIALS_FILE="${ENV_CREDENTIALS_FILE:-$WORKSPACE_ROOT/.env.credentials.local}"
+
+if [[ -f "$ENV_CREDENTIALS_FILE" ]]; then
+    # Load local-only credential defaults for controller-side SSH and remote setup.
+    # shellcheck disable=SC1090
+    source "$ENV_CREDENTIALS_FILE"
+fi
+
 REMOTE_IP_PRIMARY="${REMOTE_IP_PRIMARY:-192.168.0.121}"
 REMOTE_IP_SECONDARY="${REMOTE_IP_SECONDARY:-192.168.3.191}"
-REMOTE_USER="${REMOTE_USER:-root}"
+REMOTE_USER="${REMOTE_USER:-${ATVM_TARGET_USER:-root}}"
 PROJECT_DIR="${PROJECT_DIR:-/home/aw/code/atvm}"
 LOCAL_LOG_DIR="${LOCAL_LOG_DIR:-$PROJECT_DIR/log}"
 LOCAL_SETUP_SCRIPT="${LOCAL_SETUP_SCRIPT:-$PROJECT_DIR/atvm_setup_script.sh}"
@@ -14,6 +23,7 @@ WAIT_TIMEOUT_SECONDS="${WAIT_TIMEOUT_SECONDS:-600}"
 MODE="${1:-run-and-collect}"
 EXPECTED_IP_ARG="${EXPECTED_IP_ARG:-}"
 EXPECTED_HOSTNAME_ARG="${EXPECTED_HOSTNAME_ARG:-}"
+ATVM_PASSWORD="${ATVM_PASSWORD:-${ATVM_TARGET_PASSWORD:-}}"
 
 SSH_OPTS=(-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5)
 
@@ -157,7 +167,7 @@ if [[ "$MODE" == "run-and-collect" ]]; then
 
     echo "Running remote setup script on ${INITIAL_HOST} (disconnect is expected during IP/reboot steps)"
     set +e
-    run_ssh "$INITIAL_HOST" "chmod +x '$REMOTE_SETUP_SCRIPT' && bash '$REMOTE_SETUP_SCRIPT' --expected-ip '$EXPECTED_IP_ARG' --expected-hostname '$EXPECTED_HOSTNAME_ARG'"
+    run_ssh "$INITIAL_HOST" "chmod +x '$REMOTE_SETUP_SCRIPT' && ATVM_TARGET_PASSWORD='${ATVM_TARGET_PASSWORD:-}' bash '$REMOTE_SETUP_SCRIPT' --expected-ip '$EXPECTED_IP_ARG' --expected-hostname '$EXPECTED_HOSTNAME_ARG'"
     run_status=$?
     set -e
     if (( run_status != 0 )); then