feat(hitl): run_environment_scout reasoner + wire into plan() and harness env

Adds the new reasoner that runs once between PM and Architect when HAX is
enabled. The scout reads the PRD + repo, identifies third-party services
whose absence would block the work, and asks the user for scoped /
temporary tokens via a single Hax mega-form. Submitted values are stashed
in the in-memory credentials store keyed by run_id; the scout's return
payload OMITS scoped_credentials so the secrets never reach the control-
plane workflow_execution row.

  - swe_af/prompts/environment_scout.py — system prompt + task-prompt
    builder. Strong guidance on when NOT to ask (purely local PRD, prior
    answers already cover the question, no genuine PRD-blocking
    requirement).
  - swe_af/reasoners/pipeline.py — @router.reasoner async def
    run_environment_scout. Same wrapper shape as the three reasoners
    from PR #77; uses run_with_ask_user with budget=2.
  - swe_af/app.py:
    * plan() — Phase 1.5 calls run_environment_scout via app.call BETWEEN
      PM and architect; guarded so it runs only when HAX_API_KEY is set.
    * build() body wrapped in try/finally so clear_scoped_credentials
      ALWAYS runs on exit (success or exception). Eliminates secret
      leakage across builds within the same agent process.
    * app.harness is monkey-patched once at module load to auto-inject
      stored credentials as env vars on EVERY harness call across the
      pipeline. Avoids touching the 25+ existing call sites.

Backwards-compatible: with HAX_API_KEY unset, plan() skips the scout and
the monkey-patched harness passes os.environ through unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AbirAbbas