Add credential vault commands and preview CLI binaries

[rgarcia]

summary

• Add credential create/update from bounded file/stdin JSON, collection operations, and shared browser fill using the pinned Go SDK preview.
• Make the flow discoverable through vaults, credentials, items, invoke, and browser help. Preserve readiness/version metadata while omitting stored credential values. Redact credential write errors and disable SDK retries.
• Adapt card PATCH to the typed SDK request without changing provider behavior.
• Build Linux/macOS/Windows amd64/arm64 preview archives and checksums in Actions. No stable release, npm, or Homebrew publication. See PREVIEW.md for download instructions.

preview dependency

Pins the immutable STLC Go preview ea40d26657db27467b038ffdb877ca52e3623097 with a module replacement. The staging repository requires authentication: CI uses a contents-read GitHub App token for module download only, disables module caching, and skips fork jobs. Replace the pin with a released SDK and remove temporary auth before merging or stable publication; the release workflow enforces this.

validation

• make test (vet and all repository tests): pass.
• Vault/credential/browser-binding tests under the race detector: pass.
• Local CLI build and help inspection: pass.
• actionlint for changed workflows and bash syntax validation: pass.
• SDK HTTP contract tests cover typed requests, null clearing, collection URLs, fill outcomes, redaction, and no retries. Live API/browser validation has not been run.
• CI and Bugbot are green at c265642. The CI-built Linux binary starts and displays the new help; checksums for all six platform archives verify.

try the preview

Download the CI preview binaries (GitHub login required, 14-day retention). Includes Linux/macOS/Windows on amd64 and arm64. Extraction and API configuration instructions are in PREVIEW.md.