Purge a Leaked Secret from History

Someone committed config/credentials.env to /home/student/repos/webapp and deleted it two commits later. It is still in the history, and in the tag v1.0. The key has already been rotated; now the history must be cleaned before the repository is published.

Task

• config/credentials.env must not exist in any commit reachable from any branch, tag or other ref.
• The secret value (it starts with sk_live_) must not be readable from any reachable object.
• Every other file and change stays: the files in main's latest commit are exactly as they are now.
• Branch main, branch release and tag v1.0 still exist, with their other changes.