feat(harness): harden credential brokering to only apply with correct ephemeral secret (#19696)

## Background

Follow-up to #18859: Credential brokering so far used predictable
sandbox placeholders and injected real credentials based only on the
request destination. To harden this further, a sandbox request should
receive a brokered credential only when it presents the exact
placeholder created for that session.

This also affects the new `credentialForwarding` API from #19415.

## Summary

- Generate random credential placeholders and expose a helper for
identifying them in custom forwarding callbacks.
- Require exact placeholder header matches before host-side request
transformations inject real credentials.
- Persist forwarded placeholder values across session resume, including
cross-process resumes.
- Refresh equivalent Vercel Sandbox transformation rules in place so
resumed sessions remain idempotent.
- Update ACP credential brokering documentation, examples, and adapter
tests.

## End-to-End Verification

- `attach.ts` and `resume.ts` passed with direct and AI Gateway auth for
Claude Code, Codex, Codex ACP, fx, and OpenCode.
- Grok Build `attach.ts` and `resume.ts` passed with direct auth; AI
Gateway auth is unsupported.
- Deep Agents `attach.ts` passed with both auth modes. `resume.ts`
reached the provider but exposed the pre-existing loss of conversation
context after a full stop.
- Cline `attach.ts` passed with AI Gateway auth; direct auth is
unsupported.
- Cursor authentication was not exercised because its behavior is
controlled by the user's Cursor account rather than the harness
configuration.

## Checklist

- [x] All commits are signed (PRs with unsigned commits cannot be
merged)
- [x] Tests have been added / updated (for bug fixes / features)
- [x] Documentation has been added / updated (for bug fixes / features)
- [x] A _patch_ changeset for relevant packages has been added (for bug
fixes / features - run `pnpm changeset` in the project root)
- [x] I have reviewed this pull request (self-review)