feat(credential): generic credential injection for outbound HTTP requests

[chaliy]

Summary

• Add transparent per-host credential injection so sandboxed scripts can make authenticated API calls without ever seeing the real secrets
• Two modes: injection (headers added automatically by URL pattern) and placeholder (opaque env var replaced with real credential on the wire)
• Built on the before_http hooks system (feat(hooks): wire tool hooks into builtin pipeline, add HTTP hooks #1255) — credential policy hook runs first, injected headers overwrite existing ones (prevents spoofing)
• New Credential enum, BashBuilder::credential() and BashBuilder::credential_placeholder() APIs
• Spec, rustdoc guide, and 13 integration tests + 13 unit tests

API

// Mode 1: Pure injection — script never sees credentials
.credential("https://api.github.com", Credential::bearer("ghp_xxxx"))

// Mode 2: Placeholder — opaque env var replaced on the wire
.credential_placeholder("OPENAI_API_KEY", "https://api.openai.com", Credential::bearer("sk-real"))

New files

File	Purpose
specs/019-credential-injection.md	Design spec with threat analysis
crates/bashkit/src/credential.rs	Credential, CredentialPolicy, unit tests
crates/bashkit/docs/credential-injection.md	Rustdoc guide
crates/bashkit/tests/credential_injection_tests.rs	Integration tests

Test plan

• Injection mode: bearer, custom header, multiple headers
• Placeholder mode: env var contains placeholder, replacement in headers, not replaced for wrong host
• Overwrite semantics: script-set Authorization header replaced by policy
• URL scoping: no injection for non-matching URL, path-scoped credentials, multiple hosts
• Mixed modes: injection and placeholder together
• Debug redaction: credential values never in Debug output
• cargo fmt --check clean
• cargo clippy clean (only pre-existing dead_code in git/mod.rs)