feat: add secure origin-bound credential vault

[SarthakWade]

Summary

• add local credential management commands backed by a dedicated broker
• bind aliases and approved username metadata to canonical exact origins
• store secrets in the macOS login Keychain or Linux Secret Service with no plaintext fallback
• read passwords only from an attached foreground terminal with echo disabled and signal-safe restoration
• keep credential commands outside the browser protocol and reject them over MCP
• add atomic private metadata, bounded output, and crash-recovery transactions
• package the broker in macOS, Linux, release, installer, and npm distributions

Security boundaries

• passwords are rejected in arguments, environment variables, MCP parameters, output, logs, and metadata
• public HTTP origins, unsafe aliases, symlinked or permissive metadata, and caller-selected Linux D-Bus sockets fail closed
• macOS reports the local/unnotarized tier and uses no shared access group
• private contexts cannot access the normal vault
• retrieval and autofill remain intentionally deferred to Authentication orchestration: challenges, account selection, login, and save consent #157, where mandatory user presence is enforced

Verification

• pnpm test
• pnpm test:runtime
• pnpm test:npm
• pnpm --filter @headless/web lint
• pnpm build
• pnpm test:e2e:linux
• macOS Keychain add, list, rename, and remove smoke test
• piped-input, password-argument, insecure-origin, terminal-signal, rollback, and interrupted-transaction negative paths
• shell syntax and git diff checks

Stacked on #175, which is stacked on #171.

Closes #156.