The secret-scrub wiring reads workflow.environment_variables /
conversation_variables when building the response converter; unit tests that
mock the workflow as a bare SimpleNamespace must provide these attributes
(empty = no secrets). Fixes the workflow task-pipeline and HITL contract tests.