feat(credential-sharing): implement the Credential Sharing OpenSpec (M1-M3)

New @logicsrc/plugin-credential-sharing: a provider-neutral secret-sync engine
with env/.env, Doppler, Railway, and GitHub Secrets adapters behind one
CredentialProvider contract.

- engine: inspect -> diff -> plan -> approve -> sync -> rollback -> audit/export
- dry-run is the default for sync; --approve writes; destructive changes gated
- fingerprint-based diffs (salted SHA-256); raw values never printed or stored in
  plans/runs/audit; rollback pre-image kept in a 0600 .logicsrc vault (gitignored)
- github-secrets is write-only for values (sealed-box via libsodium), so it cannot
  be a sync source or value-restoring rollback target
- CLI: real `logicsrc credentials <providers|inspect|diff|plan|approve|sync|
  rollback|audit|export>` (replaces the prior stub)
- 4 JSON schemas registered in @logicsrc/validators
- flip logicsrc.com/credential-sharing band from coming-soon to available
- 37 tests pass; full env->env lifecycle verified; artifacts schema-validate

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/credential-sharing/src/manifest.ts

@@ -0,0 +1,22 @@
+import type { PluginManifest } from "@logicsrc/plugin-core";
+
+export const credentialSharingManifest: PluginManifest = {
+  id: "credential-sharing",
+  name: "Credential Sharing",
+  version: "0.1.0",
+  type: ["credentials", "secrets", "sync"],
+  default: true,
+  capabilities: [
+    "credentials.providers.list",
+    "credentials.inspect",
+    "credentials.diff",
+    "credentials.plan",
+    "credentials.approve",
+    "credentials.sync",
+    "credentials.rollback",
+    "credentials.audit.read",
+    "credentials.export"
+  ],
+  commands: ["credentials"],
+  env: ["DOPPLER_TOKEN", "RAILWAY_TOKEN", "GITHUB_TOKEN", "LOGICSRC_CREDENTIAL_HOME"]
+};