Scrub tracked secrets and switch ATVM docs to local credential references

- remove hardcoded credentials, tokens, registration codes, and similar secret values from tracked ATVM and CDS MCP docs
- replace those values with references to /home/aw/code/cds/.env.credentials.local and the corresponding environment variable names
- update current operator guides to instruct sourcing .env.credentials.local before credential-dependent setup and automation workflows
- update the ATVM setup scripts to consume ATVM_TARGET_PASSWORD from the environment instead of hardcoding the Ubuntu root SSH password
- scrub the remaining tracked artifact log entry that still included the old CMC registration code
- keep the local-only credential inventory in .env.credentials.local while leaving that file untracked

cdsmcp/artifacts/logs/atvm-codextest-vm-03-18-2026.log

@@ -24,7 +24,7 @@ Disk Layout
 - Destination mountpoint after completion: /mnt/destination
 
 CMC Reinstall
-- Registration code: BZHKABCODZLIOK6RTAJ4
+- Registration code: CMC_GCSTAGE_REGISTRATION_CODE from /home/aw/code/cds/.env.credentials.local
 - Endpoint: portal.gcstage.cloud.nonprod.cirrusdata.com:443
 - Result: successful
 

cdsmcp/docs/cmc-install-reference.md

@@ -4,18 +4,19 @@ This file contains the CMC install, uninstall, and reinstall fallback reference
 
 ## Default Project Rule
 - Default project: `Skidamarink`
-- Default registration code: `BZHKABCODZLIOK6RTAJ4`
+- Source `/home/aw/code/cds/.env.credentials.local` and use `CMC_GCSTAGE_REGISTRATION_CODE`
 - Default endpoint: `portal.gcstage.cloud.nonprod.cirrusdata.com:443`
 - Use a different project code only when the user explicitly requests it in that run.
 
 ## Skidamarink Install (Linux)
 ```bash
-curl https://get.cirrusdata.cloud/install-cmc | bash -s -- -rgc BZHKABCODZLIOK6RTAJ4 -gce portal.gcstage.cloud.nonprod.cirrusdata.com:443 -pkg-mode PRE_RELEASE
+source /home/aw/code/cds/.env.credentials.local
+curl https://get.cirrusdata.cloud/install-cmc | bash -s -- -rgc "$CMC_GCSTAGE_REGISTRATION_CODE" -gce portal.gcstage.cloud.nonprod.cirrusdata.com:443 -pkg-mode PRE_RELEASE
 ```
 
 ## Skidamarink Install (Windows)
 ```powershell
-iex "& { $(irm https://get.cirrusdata.cloud/install-cmc-win) } -rgc BZHKABCODZLIOK6RTAJ4 -gce portal.gcstage.cloud.nonprod.cirrusdata.com:443 -pkg-mode PRE_RELEASE"
+iex "& { $(irm https://get.cirrusdata.cloud/install-cmc-win) } -rgc $env:CMC_GCSTAGE_REGISTRATION_CODE -gce portal.gcstage.cloud.nonprod.cirrusdata.com:443 -pkg-mode PRE_RELEASE"
 ```
 
 ## Uninstall (Linux)

cdsmcp/docs/vm-lookup-and-assignment.md

@@ -47,8 +47,9 @@ This file covers vCenter VM lookup responses and the workflow for assigning exis
 - Never perform the assignment step until the operator explicitly approves after seeing that summary.
 
 ## Common VM Credentials
-- Username: `root`
-- Password: `cdsi2012`
+- Source `/home/aw/code/cds/.env.credentials.local`
+- Username: `ATVM_TARGET_USER`
+- Password: `ATVM_TARGET_PASSWORD`
 
 ## Status Output Format (Power-Off/Revert/Power-On)
 - `VM [vm name] was poweredOn, so I powered it off` (or `already poweredOff`)

cdsmcp/docs/vmware-migrateops-guide.md

@@ -8,8 +8,7 @@ This file is for workflow guidance only. Do not add specific run examples here.
 
 ## vCenter Access
 - Address: `192.168.0.201`
-- Username: `administrator@qalab.cdsi.local`
-- Password: `CDSi101!`
+- Source `/home/aw/code/cds/.env.credentials.local` and use `VCENTER_USER` plus `VCENTER_PASSWORD`
 - Standard CLI path: `/home/aw/.local/bin/govc`
 - Use only this standard vCenter login for vCenter actions unless explicitly instructed otherwise.
 - Do not use `192.168.3.190` for vCenter actions; that machine is reserved for Cypress ATVM automation.
@@ -23,7 +22,7 @@ This file is for workflow guidance only. Do not add specific run examples here.
 - Any other VM IP must be obtained live from vCenter for that run only.
 - Do not carry forward ad-hoc VM IPs from previous runs in runbooks.
 - When the operator refers to `192.168.3.191`, assume ATVM target SSH access should ignore host key mismatch by default with `-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`.
-- When the operator refers to `192.168.3.191`, assume default SSH credentials `root / cdsi2012` unless the operator explicitly overrides them.
+- When the operator refers to `192.168.3.191`, source `/home/aw/code/cds/.env.credentials.local` and use `ATVM_TARGET_USER` plus `ATVM_TARGET_PASSWORD` unless the operator explicitly overrides them.
 
 ## Related References
 - VM lookup, datastore reporting, and FC/disk assignment: