Update documentation around the encryption experiment and address a few bugs

[dkotter]

What?

Update our documentation to make it more clear what the encryption experiment does and does not do. Make a few refinements / bug fixes along the way.

Why?

We've had some reports that seem to misunderstand the encryption experiment, most importantly they seem to think that encrypted data is locked down to the AI plugin only and shouldn't be accessible by other plugins. This is not how that experiment was built and honestly not sure there's a way to achieve this within WordPress, since WordPress allows plugins to do basically anything.

This PR updates the documentation around this experiment to make it more clear about what it is doing and things it won't help with, like preventing other plugins from accessing API keys.

In addition, a few modifications/fixes have been done based on these reports, namely ensuring we better detect the calling plugin instead of always attributing everything to the AI plugin and passing the calling plugin into our logging methods.

How?

• Updates our main documentation as well as the README that lives with our vendored secrets manager code and some inline documentation
• Ensure caller attribution skips any frames that come from the vendored code so we properly match the calling plugin name
• Pass the detected plugin into our log hooks

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Opus 5
Used for: Reviewing some reports and helping verify what actually needs fixing. Once a plan was settled on, it executed the plan with final review and testing by me

Testing Instructions

Ensure the encryption experiment still works as expected. Easiest to follow instructions in the original PR, #560

Changelog Entry

Fixed - Ensure caller detection in the encryption experiment properly matches the calling plugin, not the host plugin.

Developer - Documented the Key Encryption threat model: what encrypting API keys at rest does and does not protect against, and why the caller-supplied plugin context is a namespace-collision guard rather than an isolation boundary between plugins.

Developer - The secrets_accessed and secrets_{$operation} actions now receive a backtrace-derived detected_plugin alongside the caller-asserted plugin value, so audit consumers can attribute operations and flag a mismatch.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: dkotter <dkotter@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.57%. Comparing base (7e92a70) to head (6a162f8).

Additional details and impacted files

@@              Coverage Diff              @@
##             develop     #909      +/-   ##
=============================================
+ Coverage      80.43%   80.57%   +0.14%     
- Complexity      2565     2568       +3     
=============================================
  Files            110      110              
  Lines          10448    10453       +5     
=============================================
+ Hits            8404     8423      +19     
+ Misses          2044     2030      -14     

Flag	Coverage Δ
unit	80.57% <100.00%> (+0.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.