Agent Framework update turns SecretString into a wrapper

Microsoft's Agent Framework released python-1.18.0 on September 10, and the headline change is a type swap most teams won't notice until something breaks. SecretString used to be a str subclass, so you could drop it into an f-string or a header dict and it just worked. Now it's a masked wrapper instead.

That matters across all ten provider packages that use the type. Code that interpolates a SecretString directly, say building an auth header, will fail after the upgrade.

Two more breaking changes ride along in the same release. GitHub Copilot's workspace file hooks move behind an enable_file_hooks flag, off by default. Foundry checkpoint deserialization is restricted by default too, though the release doesn't name a matching flag for it. Neither change is documented as a headline feature. Both change what runs without you asking for it.

The release isn't only subtraction. It adds shared vector-store abstractions with portable filters, so a filter written for one backend should work against another. Azure AI Search and Redis connectors are included. Qdrant and pgvector show up as alpha.

The release notes don't say whether there's a compatibility shim for the old SecretString subclass behavior. The safest read is that there isn't one, which means the fix is finding every direct string use of SecretString before the dependency bump, not after.