agent-credential-broker: fork of vaultwarden-agent-broker + OpenBao backend

Mechanical rename (package agent_credential_broker; entry points
agent-broker{,-mcp,-plugin}; env AGENT_BROKER_*; paths agent-broker;
agent-browser credential provider 'broker'; MCP server name agent-broker).

New backend 'openbao': stdlib-only HTTP client for OpenBao/Vault KV v2
(approle login or token file/env; metadata-only ref index; lazy re-login
on 401/403; token renewal). bitwarden-cli backend kept as transition.

profiles/example-echo.json

@@ -0,0 +1,12 @@
+{
+  "id": "example-echo",
+  "description": "Test profile: echoes argv, reads the injected credential only inside the child.",
+  "executable": "echo-fixture",
+  "injection": {"method": "env", "name": "EXAMPLE_TOKEN"},
+  "allowed_subcommands": ["hello", "version"],
+  "arg_regex": "^[\\w .\\-/:]+$",
+  "forbidden_regex": "[;&|`$<>(){}\\[\\]\n]|(^|/)\\.\\.(/|$)",
+  "target_hosts": ["example.com"],
+  "timeout": 10,
+  "max_output_bytes": 8192
+}

profiles/gitea-api.json

@@ -0,0 +1,16 @@
+{
+  "id": "gitea-api",
+  "description": "curl against the Gitea2 API. The token is rendered into a 0600 tmpfs curl -K config file (header = \"Authorization: token {SECRET}\") so it never appears on argv or env.",
+  "executable": "curl",
+  "injection": {
+    "method": "file",
+    "file_template": "header = \"Authorization: token {SECRET}\"\nsilent\nshow-error\nfail\nmax-time = 25\n"
+  },
+  "args_template": ["-K", "{SECRET_FILE}"],
+  "allowed_subcommands": [],
+  "arg_regex": "^[\\w ./:@\\-+=%{},-]+$",
+  "forbidden_regex": "[;&|`$<>(){}\\[\\]\n]|(^|/)\\.\\.(/|$)|Authorization:|token=",
+  "target_hosts": ["git.paginica.com"],
+  "timeout": 30,
+  "max_output_bytes": 65536
+}