Fix: always load flat secret as primary regardless of labeled secrets

cdk/cdk.out/AgentClawStack.template.json

@@ -387,7 +387,7 @@
    "Properties": {
     "Code": {
      "S3Bucket": "cdk-hnb659fds-assets-495395224548-us-east-1",
-     "S3Key": "4f645198a38249aec43db7c3d289ab4896fad437f79e8cfe1ff77fc2e788167c.zip"
+     "S3Key": "647684a0ff5a7a3df590aa5532173310dace910d7081be6f3a642f7e81dabc06.zip"
     },
     "Environment": {
      "Variables": {
@@ -423,7 +423,7 @@
    ],
    "Metadata": {
     "aws:cdk:path": "AgentClawStack/AgentRunner/Resource",
-    "aws:asset:path": "asset.4f645198a38249aec43db7c3d289ab4896fad437f79e8cfe1ff77fc2e788167c",
+    "aws:asset:path": "asset.647684a0ff5a7a3df590aa5532173310dace910d7081be6f3a642f7e81dabc06",
     "aws:asset:is-bundled": false,
     "aws:asset:property": "Code"
    }
@@ -949,6 +949,12 @@
        "Resource": "arn:aws:secretsmanager:us-east-1:495395224548:secret:agent-claw/google-credentials/*",
        "Sid": "PerUserGoogleCredentialsReadRuntime"
       },
+      {
+       "Action": "secretsmanager:ListSecrets",
+       "Effect": "Allow",
+       "Resource": "*",
+       "Sid": "GoogleCredentialsListRuntime"
+      },
       {
        "Action": [
         "events:PutRule",
@@ -1149,7 +1155,7 @@
    "Properties": {
     "Code": {
      "S3Bucket": "cdk-hnb659fds-assets-495395224548-us-east-1",
-     "S3Key": "b45b92872bd4af9d3688817f862e6574ff6b4903e68b140bcee6fe0b2678c645.zip"
+     "S3Key": "99aabce70089266e2352cb313d55ee18b849e39c418e8e9cd25dea8c4bf85fc4.zip"
     },
     "Environment": {
      "Variables": {
@@ -1194,7 +1200,7 @@
    ],
    "Metadata": {
     "aws:cdk:path": "AgentClawStack/OAuthHandler/Resource",
-    "aws:asset:path": "asset.b45b92872bd4af9d3688817f862e6574ff6b4903e68b140bcee6fe0b2678c645",
+    "aws:asset:path": "asset.99aabce70089266e2352cb313d55ee18b849e39c418e8e9cd25dea8c4bf85fc4",
     "aws:asset:is-bundled": false,
     "aws:asset:property": "Code"
    }