v0.4.5 — preflight aware of $workdir/.creds

Follow-up to v0.4.4. After the canonical credential store moved to $workdir/.creds, spectator preflight was still only checking the driving-shell env and the legacy ~/.ngc/api_key location. So a host with v0.4.4-populated .creds but no env vars in the running shell would preflight as if the keys were missing — even though every actual bash payload would have found them via the source-block.

preflight now ssh-probes $workdir/.creds first (set -a; . .creds; set +a; echo \"${NGC_CLI_API_KEY:+SET}\"). Three priority-ordered sources are now reflected in the rendered table:

Source	Reported as
.creds on target	in <workdir>/.creds on target (v0.4.4+; sourced by every bash payload)
Driving-shell env ($NGC_CLI_API_KEY / $NVIDIA_API_KEY)	set in driving shell (forwarded over SSH; first install will persist to .creds)
Legacy ~/.ngc/api_key (NGC only)	~/.ngc/api_key present on target

spectator preflight gained a --workdir / -w flag so the .creds probe targets the right path; spectator install already had --workdir and now threads it through to collect_checks too.

Tests: 67/67 (was 65, +2): one mocks _exec to return NGC=SET / NVIDIA=SET from the .creds probe and verifies both checks flip to ok with the right detail; one mocks empty .creds and verifies the env-var fallback kicks in for NGC and NVIDIA correctly fails.

Migration

None. Existing v0.4.4 .creds files are picked up immediately by the new preflight probe.