feat(credentials): add reusable bundle wizard

[orga-agent]

Summary

• add a reusable Go wizard for generating the complete five-field project credential bundle
• generate ES256 signing material, five-year role JWTs, and canonical Supabase opaque API keys
• validate every generated bundle with the operator production validator before copying fields
• require a trusted interactive terminal and send OSC52 only to the controlling terminal, never stdout
• clear the clipboard after every field, on failure, and on interruption
• document that agents hand the command to a human instead of running it

Verification

• go test ./...
• go build ./...
• make lint
• non-TTY refusal check confirms no credential-shaped output
• wizard tests use an injected clipboard and verify the copied bundle with the production validator