feat(credential): advertise stable vault capabilities

[pawellisowski]

Summary

• add a scoped machine-readable credential capability discovery command
• advertise the accepted secret.put.v1 and secret.revoke.v1 semantic fingerprints
• document the mapping to the canonical credential put/delete verbs

Test plan

• cargo fmt --manifest-path cli/Cargo.toml --all -- --check
• cargo clippy --manifest-path cli/Cargo.toml --all-targets -- -D warnings
• cargo test --manifest-path cli/Cargo.toml
• real isolated AWARE_HOME put/status/idempotent-delete lifecycle
• codex exec review --base main

Refs #448