Constant SESSION_SNAPSHOT_ANNOTATION 

pub const SESSION_SNAPSHOT_ANNOTATION: &str = "kopiur.home-operations.com/session-snapshot";

Annotation naming the Snapshot (in the Job’s own namespace) a browse session was started for. The operator re-checks that snapshot’s pinned credentialProjection before copying anything, so a Job alone, without a snapshot that opted in, never gets credentials.