feat(#65 P4): align Credentials modeling across machine/proto/RCM layers

[yzxoi]

Problem

Credentials have three different modeling approaches across layers (Issue #65, P4):

Layer	Type	Representation
machine	Model.credentials: Option<String>	Resolved API key string
proto	CredentialSpec { oneof { env, literal } }	Preserves source distinction
RCM	credentials_env + credentials_key (two separate Option fields)	Two fields, compile-time mutual exclusion check

This means:

• machine::Model always stores the resolved API key — loses the original source info
• RCM syntax requires two separate fields with manual mutual exclusion
• Error messages in compile show "mutually exclusive" instead of guiding the user

Design considerations

The proto CredentialSpec design is actually the cleanest — it preserves the source distinction via oneof. Consider aligning machine::Model and RCM syntax to match this pattern:

message CredentialSpec {
  oneof source {
    string env = 1;
    string literal = 2;
  }
}

Out of scope

• Does not change credential behavior or resolution logic
• Does not introduce credential storage or rotation

Parent: #65

[github-actions]

$【分类与优先级】\n- 分类：enhancement\n- 优先级：P3\n\n【重复检查】\n未发现明显重复 issue。\n\n【一句话总结】\nCredentials 在 machine、proto、RCM 三层存在三种不同的建模方式，导致来源信息丢失与互斥检查冗余；建议将 machine 与 RCM 层的凭证表示对齐到 proto 的 CredentialSpec oneof 模式，以统一跨层语义并改善编译错误提示。