feat: add credential-path verification registry

[TacoRocket]

Summary

• add a reusable chain handler registry and move credential-path family logic into registered handlers
• keep Key Vault verification in the credential-path flow while preserving operator-facing proof boundaries
• add registry-focused tests and fixture coverage for the refactor

Verification

• python3 -m pytest -q tests/test_credential_path_registry.py
• python3 -m pytest -q tests/test_cli_smoke.py -k 'credential_path'
• python3 -m pytest -q tests/test_terminal_ux.py -k 'chains_table_mode_surfaces_priority_and_next_review or chains_keyvault_note_prefers_current_identity_access_sentence'
• python3 -m pytest -q tests/test_visibility_tiers.py
• python3 -m pytest -q tests/test_chain_semantics.py
• python3 -m ruff check src/azurefox/chains/credential_path.py src/azurefox/chains/handler_registry.py src/azurefox/chains/runner.py src/azurefox/env_var_hints.py tests/test_credential_path_registry.py tests/test_chain_semantics.py tests/test_cli_smoke.py