feat(egress): keep artifact credentials off a Session's egress policy

[teemow]

Closes #286.

Problem

A private skill or plugin source binds its git credential (an App or deploy token) as authorization: Basic on the source's host. The revision's one Credentials list compiled both the golden template's default egress policy, which the golden boot needs to fetch the source, and every Session actor's own policy (create, repointTarget and its rollback). So any request a session's sandbox sent to that host with an Authorization header (a shell tool, an MCP client, gh) left with the token, and read what the token can reach rather than what the person of the turn can.

Proposed solution

One carried, upstream-ready commit: a binding names the actors it is for.

• egress.Credential gains Scope (json:"scope,omitempty"): empty for every actor (model and MCP bindings, unchanged), golden for the golden boot only. CompileCredentials scopes every artifact binding golden; CanonicalCredentials validates the scope and keeps its same-host-and-header rule.
• ActorTemplateForRevision still compiles the template's default policy from every binding.
• The three Session sites compile through one helper, sessionEgressPolicy, from egress.ForActors(bindings). The source's host stays allowed from the sandbox, unauthenticated.
• Substrate gives a new Actor its template's default policy at creation, which now differs from the Session's. Session creation (and a checkpoint fork) passes the template's default to EnsureActorEgressPolicy as the inherited policy: an existing policy equal to it is replaced with the Session's before the Actor first runs, one equal to the Session's is accepted as before (a retried create), any other allowlist is still refused (fix(substrate): replace a new Actor's inherited template allowlist).
• refactor(session): drop the execute path's dead revision writes: two assignments after the last read that ineffassign reports once the create path reads the revision through the helper.
• No migration: the JSONB runtime_revision.credentials takes the field. The scope is part of the revision digest, so an agent with a credentialed source renders a new revision once (a golden boot) and its READY sessions are repointed by the superseded-revision mechanism, with their policy replaced; other agents keep their digest. No actorTemplateFormat bump: the golden policy is unchanged.
• docs/architecture/credential-injection.md describes the scope; FORK.md has the row with the upstream exit (the follow-up a review note on feat(skills): private Git skill sources via egress gateway credentials kagent-dev/kagent#3099 names, once that pull request is merged).

This lands beside #147, which changes translator/credentials.go and egress/credentials.go in other hunks; whichever lands second rebases.

Acceptance criteria

• Unit tests: TestCompileCredentialsScopesArtifactBindingsToTheGoldenBoot (artifact golden, model and MCP none), TestActorTemplateForRevision (the default policy carries the artifact binding), TestSessionEgressPolicyLeavesOutTheGoldenBootsCredentials (the policy passed to EnsureActorEgressPolicy on create and the one repointTarget builds carry none of it and keep the model and MCP bindings), TestRevisionDigestChangesOnlyWithAnArtifactBinding (a model binding keeps the digest pinned from the base commit; an artifact binding changes it), TestForActors, TestCanonicalCredentials, TestEnsureActorEgressPolicyReplacesTheInheritedDefault.
• TestGitArtifactCredentialDelivery (every harness) keeps its golden-boot assertion, limited to the fixture's requests recorded before the Agent reported Ready, and gains a turn in which the sandbox's shell tool (driven by the interaction mock) runs git ls-remote against the source twice: once without Authorization, as git does before a challenge, and once with the placeholder header the golden boot sends. Every request recorded from Ready on carries the Secret value in no header and reaches the fixture (none is denied by the gateway): the bare one arrives bare, the placeholder one with the placeholder, not replaced. The placeholder request is the regression check, since the gateway replaces only a header the request carries: before this change it arrived with the Secret.
• The existing model and MCP credential e2e cases stay green; TestSessionEgressDeniesUnconfiguredDestination unchanged.
• Released as the line's next release candidate.

[teemow]

(Written by an agent.) Replaced by #366: the base moved 35 commits (the Vertex AI credential authority, the Session workspace volumes, one carried file per change under fork/carried) and this branch conflicted with it; this line rebase-merges, so the change moved to a fresh branch of the base.