agent-credential-broker: fork of vaultwarden-agent-broker + OpenBao backend

Mechanical rename (package agent_credential_broker; entry points
agent-broker{,-mcp,-plugin}; env AGENT_BROKER_*; paths agent-broker;
agent-browser credential provider 'broker'; MCP server name agent-broker).

New backend 'openbao': stdlib-only HTTP client for OpenBao/Vault KV v2
(approle login or token file/env; metadata-only ref index; lazy re-login
on 401/403; token renewal). bitwarden-cli backend kept as transition.

agent_credential_broker/adapters/__init__.py

@@ -0,0 +1,58 @@
+"""Adapter registry. Adapters receive (item, policy, params, config)
+in-process, inject the secret through an approved channel, execute a
+bounded operation, and return sanitized metadata only."""
+
+from __future__ import annotations
+
+from ..errors import denied
+
+
+def _load():
+    from . import http, ssh, git, cli_profile, browser
+    return {
+        "http": http.run,
+        "ssh": ssh.run,
+        "git": git.run,
+        "cli-profile": cli_profile.run,
+        "browser": browser.run,
+    }
+
+
+def _mods():
+    from . import http, ssh, git, cli_profile, browser
+    return {
+        "http": http,
+        "ssh": ssh,
+        "git": git,
+        "cli-profile": cli_profile,
+        "browser": browser,
+    }
+
+
+class _Registry:
+    _impl = None
+
+    @classmethod
+    def _mod(cls, adapter):
+        if cls._impl is None:
+            cls._impl = _mods()
+        mod = cls._impl.get(adapter)
+        if mod is None:
+            raise denied(f"unknown adapter {adapter!r}")
+        return mod
+
+    @classmethod
+    def validate(cls, adapter, item, policy, params, config):
+        """Pre-execution policy/argument validation -- runs BEFORE the
+        confirmation gate so target errors surface first."""
+        mod = cls._mod(adapter)
+        fn = getattr(mod, "validate", None)
+        if fn:
+            fn(item, policy, params, config)
+
+    @classmethod
+    def run(cls, adapter, item, policy, params, config):
+        return cls._mod(adapter).run(item, policy, params, config)
+
+
+registry = _Registry()