feat: phantom-credential brokering for tool execution (credential never enters the child)

[tcconnally]

Summary

Implements the phantom-credential brokering pattern (agent-core #11): the real credential never enters the child process.

New perseus_agent_core/credentials.py:

• CredentialBroker (Protocol interface) + PhantomCredentialBroker — supervisor-side vault, phantom-token injection, boundary swap, zeroise-on-exit.
• CredentialVault — holds real secrets; zeroise() overwrites the secret in memory on exit.
• broker() — creates a phantom-token lease; policy deny or timeout raises BrokerDenied with zero credential material (null effect on deny).
• execute() — runs the tool child with only the phantom token in its environment (PERSENS_PHANTOM_TOKEN); lease revoked/zeroised on exit (including timeout).
• swap_at_boundary() — the proxy: validates the phantom and injects the real credential only inside the context (the network boundary); real secret zeroised when the context exits.
• git_style_tool() — reference git/gh-style invocation wired through the broker.
• Receipts (BrokerLease.as_receipt) — credential id, tool, outcome, caller-supplied canonicalized argv fields; never the secret value.

Tests (actual output)

python -m pytest tests/test_credentials.py -q → 7 passed in 0.11s:

• child env/file/argv contain only the phantom token — the real credential never enters the child (probe process asserts PERSENS_CREDENTIAL is None)
• boundary swap injects the real credential and zeroises on exit (vault no longer holds it)
• denied path (policy) and timeout both raise BrokerDenied with no material
• aborted path leaves no credential material; phantom zeroised
• receipts never contain the secret value or the phantom token

Full suite: 10 passed; the 3 test_vault_backend.py failures are pre-existing (reproduced on clean main at ac05a11). git diff --check → clean.

Acceptance criteria

• Child process never holds the real credential (test asserts env/file/argv contain only phantom token)
• Proxy swap happens at the boundary and the real credential is zeroised after use
• Denied/aborted path leaves no credential material in memory or disk
• Ledger receipt records the broker event without the secret value

Closes #11