Desk review — #1950 (headerless tables for env vars/secrets & passkeys)

Verdict: READY TO MERGE. Clean, focused change that meets all three acceptance criteria on both surfaces. Reviewed in two rounds (breadth across correctness/robustness/elegance/tests/boundaries, then independent re-verification of every candidate blocker).

Verification performed

• CI: gh pr checks → 45 pass, 5 skipping, 0 fail/pending (all Build/Lint/Format/Knip/Opengrep/Migrations/UI/Browser + 16 Playwright platform shards green).
• i18n tests: bunx vitest --run lib/i18n/messages.test.ts → 23 passed (parity + usage enforce mode). en/de/fr at key parity for the envEditor and twoFactor.passkeys subtrees; no dangling refs to the removed envEditor.none / passkeys.empty; de-CH overlay carries no stale keys.
• Lint: oxlint --type-aware on both changed files → 0 warnings, 0 errors.

What's good

• Acceptance criteria met: both render as headerless @tale/ui/table tables; when empty nothing is rendered (env editor keeps only Add/Save, as intended; passkeys render nothing); per-row trash icon gated by DeleteDialog.
• Shared EnvVarListEditor prop contract unchanged — agent-env-editor and workflow-env-editor callers unaffected.
• Security: confirm dialogs and aria-labels expose only the key/passkey name, never secret values; the masked preview (••••) is never persisted (value field flips to a cleared password input on focus; untouched secrets are skipped on save via r.isSecret && !r.secretDirty && r.existingKey === key).
• data-no-hover, w-0/w-48 cell sizing, and DeleteDialog usage all follow repo conventions; passkey early-return sits after all hooks (no hooks-order issue); revoking is reset in finally so the dialog can never get stuck.

Non-blocking notes (optional follow-ups, do not block merge)

1. env-var-list-editor.tsx — pendingRemove is an array index. If a reactive rows update lands while the confirm dialog is open and there are no local edits (dirty.current === false), the snapshot can shift indices and the index would point at a different row. Worst case is local-state-only until the user clicks Save, and the dialog preview reflects the changed row, so it's self-evident. Low probability for a per-agent/per-workflow settings editor. If you touch this later, keying the pending removal by the row's existingKey/a stable id instead of the index removes the hazard entirely.
2. No unit/story tests were added for either component (the repo has none for them today; behavior is covered by the green Playwright suite). Worth a follow-up to add coverage for the confirm-remove / confirm-revoke flows.
3. Token-source binding re-saves on every Save even when the slug is unchanged (idempotent; appears pre-existing). Minor.

None of the above gates the merge.