P1: Add setup-managed credential references

[sfloess]

Implements the setup-side foundation for the credential/capability boundary.

• Adds secret-free credential references to profiles via flossware_setup.credential_refs.
• Supports deployment-selected credential sources without storing secret material.
• Adds validation and tests for references and source identifiers.
• Documents the current environment-variable workflow as a backend, rather than making .bashrc the architecture.
• Documents the ownership boundary: agent-setup manages references/policy; Loom requests capabilities; model-router resolves authorized credentials.

Related FlossWare #5.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud