Summary

Adds profile-backed credential discovery for providers v2 so explicit --from-existing flows can discover credentials from provider profile metadata instead of requiring a hard-coded provider plugin. The discovery schema references credential names, keeps env vars sourced from credentials[*].env_vars, and keeps v2 provider attachment explicit.

Related Issue

Closes #1460

Changes

• Adds ProviderProfileDiscovery to the provider profile proto and YAML DTO.
• Adds discovery.credentials to the built-in GitHub, Claude Code, and NVIDIA profiles.
• Implements generic profile-backed discovery that scans referenced credential env vars and stores discovered credentials under the actual env var key.
• Routes provider create/update --from-existing through profile-backed discovery when providers_v2_enabled is true, while keeping legacy registry discovery for v1.
• Disables command-derived provider inference during sandbox creation when providers v2 is enabled, so v2 does not auto-attach providers from commands.
• Adds unit and CLI integration coverage for profile discovery success/failure and profile discovery import/export behavior.

Testing

• mise run pre-commit passes
  • Ran RUSTC_WRAPPER= mise run pre-commit; it failed on pre-existing ignored architecture/plans/*.md markdown lint errors unrelated to this branch. Rust check completed before I stopped the run after the markdown failure had already made the task fail.
• Unit tests added/updated
  • CARGO_TARGET_DIR=/tmp/openshell-target-1460 RUSTC_WRAPPER= cargo test -p openshell-providers
  • CARGO_TARGET_DIR=/tmp/openshell-target-1460 RUSTC_WRAPPER= cargo test -p openshell-cli --lib
  • CARGO_TARGET_DIR=/tmp/openshell-target-1460 RUSTC_WRAPPER= cargo test -p openshell-cli --test provider_commands_integration
  • CARGO_TARGET_DIR=/tmp/openshell-target-1460 RUSTC_WRAPPER= cargo test -p openshell-cli --test ensure_providers_integration
  • CARGO_TARGET_DIR=/tmp/openshell-target-1460 RUSTC_WRAPPER= cargo clippy -p openshell-providers -p openshell-cli --all-targets -- -D warnings
  • CARGO_TARGET_DIR=/tmp/openshell-target-1460 RUSTC_WRAPPER= cargo check -p openshell-server --tests
• E2E tests added/updated (if applicable)
  • Not applicable; this changes explicit profile discovery and CLI wiring, not sandbox runtime policy enforcement.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)
  • Not applicable; no architecture-doc change for this incremental provider profile discovery implementation.