Add ccc-keygen for secrets file generation

--create <names>  generates secrets.json with random 32-byte hex secrets
--filter <names>  extracts a subset of users into filtered-secrets.json
--input/--output  override default file paths

Removes hardcoded user/agent assumptions from secrets.example.json.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

secrets.example.json

@@ -1,6 +1,6 @@
 {
 	"users": {
-		"agent": { "secret": "change-me-agent", "canApprove": [] },
-		"user":  { "secret": "change-me-user",  "canApprove": ["agent"] }
+		"<username>": { "secret": "<hex secret>", "canApprove": [] },
+		"<username>": { "secret": "<hex secret>", "canApprove": ["<username>"] }
 	}
 }