feat: implement credential-path chains

[TacoRocket]

Summary

• add the first real chains family with azurefox chains credential-path
• join env-vars, tokens-credentials, databases, storage, and keyvault artifacts into conservative credential-path rows
• add reusable chain semantics, priority ordering, target-resolution wording, and safer partial-visibility behavior
• wire schema, help, table rendering, and output writing for shipped chain output
• add regression coverage for chain semantics, CLI smoke, terminal UX, and blocked-target summary behavior

Validation

• python3 -m ruff check src tests
• PYTHONPATH=src python3 -m pytest tests/test_chain_semantics.py tests/test_cli_smoke.py tests/test_terminal_ux.py tests/test_help.py
• pre-push guardrail: 228 passed, 2 deselected