Secretless brokered CLI execution

[ReganBell]

Brokered CLI credentials in the non-legacy cutover modes were still injected into the conversation's general sandbox environment in direct messages, where any executed command can read them, and the shared-room owner-auth path interpolated vended values into shell function text that session records then persist. Non-legacy brokered services are now reachable only through a credential_exec tool that takes a service enum plus literal argv — the model never supplies a command string or binary path. Each invocation vends credentials on demand, runs the deployment-declared binary once in a fresh scratch box that is destroyed afterward, and masks stdout/stderr with the vended values (including encoded variants) before anything reaches the model or durable records. Ephemeral-only mode denies direct binary execution with a deterministic pointer to the tool, the eager per-turn credential vend is gone, credential_exec consumes command approvals exactly like execute, and legacy mode is unchanged for rollback.

Deployment notes

New credentialexec tool + orchestrator brokering only surfaces when the deployment layer
_ g y py y
marks tools as broker/ephemeral_only — stock upstream (no such layer) sees no new tool and no
behavior change
Behavior flip for layers already using ephemeral_only: direct execution of those commands is now
denied (prepended to the scope policy so a scope-level allow can't outrank it) — the intended
contract, but a layer relying on direct runs would notice
Harness interface gains a member — out-of-tree harness implementations need a one-line
update; no DB, no env, approval-grant flow reuses the existing execute path

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}