feat(zeroshot-rust): resolve native credentials into ephemeral capabilities

[tomdps]

Parent

• feat(zeroshot-rust): parse isolated native configuration and named profiles #689 — feat(zeroshot-rust): add native config, binding references, and credential resolution

Execution

AFK. Start only after every issue in Blocked by is merged, required CI is green for the resulting dev SHA, and the worktree is created from a freshly fetched origin/dev.

Outcome

Resolve manifest-declared logical credential requirements into bounded ephemeral capabilities and leases without persisting secret values.

Authoritative contracts/current state

#689 owns native settings/profile parsing and #769 owns secret-free requirements/bindings. Existing provider contracts accept opaque capabilities; drivers must receive already-resolved capabilities rather than reading ambient state.

Owned scope

• Implement explicit native credential-source resolution for supported provider/source/issue profiles with deterministic precedence and no Node/keychain/config fallback outside declared native sources.
• Represent credentials as opaque non-serializable capabilities/leases with bounded lifetime, zeroization/release hooks, and stable secret-free identity/digest for pool keys.
• Acquire only the requirements in the admitted manifest immediately before use; cancellation/deadline/partial acquisition releases every lease exactly once.
• Emit only safe typed missing/permission/authentication faults; raw values, headers, tokens, helper output, and source paths never enter logs/ledger/export.

Acceptance criteria

• Precedence, duplicate/conflict, missing, malformed, expiry, cancellation, and release races are deterministic.
• Secret fixtures are absent from Debug, serialization, fault, observation, ledger, and export surfaces.
• Driver/source/issue fakes consume capabilities without opening config/environment/keychain themselves.
• No provider request, driver selection, manifest mutation, or Node fallback occurs.

Verification

cargo test -p zeroshot-rust --test credential_resolution
cargo test -p zeroshot-rust --test credential_lifecycle
cargo test -p zeroshot-rust --test architecture
npm run rust:check
npm run protocol:check
npm run typecheck
npm run lint
npm run test:unit
opcore check --changed

Every named focused target is an issue-owned deliverable and must execute non-zero tests before the common gates.

Non-goals

• Settings/profile schema ownership.
• Provider/source/issue network operations.
• A global credential cache, secret persistence, or generic secret scanner.

Blocked by

• feat(zeroshot-rust): parse isolated native configuration and named profiles #689 — feat(zeroshot-rust): add native config, binding references, and credential resolution
• feat(zeroshot-rust): compile secret-free native manifests and worker bindings #769 — feat(zeroshot-rust): compile secret-free native manifests and worker bindings

Unblocks

• feat(zeroshot-rust): add the generic CLI worker driver #672 — feat(zeroshot-rust): add the generic CLI worker driver
• feat(zeroshot-rust): add the pooled ACP worker driver #673 — feat(zeroshot-rust): add the pooled ACP worker driver
• feat(zeroshot-rust): add the trusted-profile Gateway worker driver #674 — feat(zeroshot-rust): add the trusted-profile Gateway worker driver
• feat(zeroshot-rust): resolve bounded canonical task inputs and issue-provider adapters #675 — feat(zeroshot-rust): add task sources, issue providers, and bounded durable context
• feat(zeroshot-rust): add the GitLab SourceCodeProvider adapter #682 — feat(zeroshot-rust): add GitLab and Azure DevOps SourceCodeProvider adapters
• feat(zeroshot-rust): add Azure DevOps SourceCodeProvider adapter #762 — feat(zeroshot-rust): add Azure DevOps SourceCodeProvider adapter
• feat(zeroshot-rust): add GitHub SourceCodeProvider adapter and authoritative ship inspection #760 — feat(zeroshot-rust): add GitHub SourceCodeProvider adapter and authoritative ship inspection