Add Zig credential effects

[marcusschiesser]

Summary

• add Zig UiApp effects for setting, getting, and deleting credentials by stable (service, account) key
• reuse the existing platform credential services on macOS, Linux, Windows, and the null test platform; no new native bridge or TypeScript command surface
• reject credential reads with recording_unsupported before OS access while session recording is active
• journal and replay credential operation/outcome metadata without ever serializing secret bytes
• securely wipe effect-owned set copies and delivered get buffers

Closes #272.

API

.load_token => fx.getCredential(.{
    .key = credential_key,
    .service = "com.example.notes.openai",
    .account = "default",
    .on_result = Effects.credentialMsg(.credential_result),
}),

The same option shape drives fx.setCredential (plus secret) and fx.deleteCredential. EffectCredentialResult reports op, outcome, and an update-scoped secret only for a successful get. Outcomes are ok, not_found, failed, rejected, recording_unsupported, and cancelled.

Recording and replay

Recording keeps the live request's occupied-key window but resolves get as recording_unsupported without calling the credential store. Its metadata record retires the replay-side parked fake request at the same delivery point. Set/delete remain available and journal only their operation/outcome.

Replay rejects hand-edited credential records that carry payload bytes or an operation/outcome shape the recorder cannot produce. The guarantee is scoped to credential effect records; ordinary UI input events are not general-purpose secret-redacted.

Tests

• zig build test
• zig build test-desktop-runtime-core
• zig build validate
• pnpm --dir docs check
• scripts/gate.sh fast (all change-relevant suites pass; local aggregate remains red for two environment/baseline checks: the package proxy cannot install the pinned scriptc@0.0.22 required by two TypeScript examples, and toggle-big-view measures ~10.7 ms against the 9 ms Apple Silicon budget; the same benchmark failure reproduces on untouched main)

The new tests cover fake request copies and feeds, validation, duplicate keys, cancellation, real null-platform set/get/delete/not-found behavior, recording-time get refusal, metadata-only codec output, strict replay record validation, and replay-fed rejection ordering.

[vercel]

@marcusschiesser is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.