fix: pass provider credentials to preflight

[rudijetson]

Closes #23

Summary

• build the provider-declared environment once for Agent Host inspection
• pass that environment to version and authentication probes while retaining executable PATH construction
• prove that declared managed credentials are injected and unrelated stored secrets remain excluded
• refresh the checked-in CLI bundle

Stack

This PR is intentionally based on #22 so its full-suite check includes the Registry cache-race repair. Its own diff is limited to provider preflight behavior, one regression, proof documentation, and generated bundle output.

Verification

• focused red/green regression: 2 passed
• provider and preflight suites: 40 passed
• pnpm test: 635 passed
• reproducible pnpm build
• architecture debt scan: 0 findings
• npm pack --dry-run --json: 6 expected files
• git diff --check

No live provider, real secret storage, primary dirty checkout, or system/ files were modified.