feat(harness): add `credentialForwarding` setting to bridge backed harness adapters for granular control (#19415)

## Background

Applications that broker credentials outside `HarnessAgent` need control
over the credential values forwarded into bridge-backed sandbox
processes, including the ability to substitute ephemeral values.

## Summary

- Add an optional `credentialForwarding` callback that receives each
real or masked credential and its final sandbox environment variable
name.
- Apply the callback once per forwarded credential across bridge-backed
harness adapters, including ACP profile-mapped credentials, while
preserving existing behavior when omitted.
- Document the setting and enforce its presence in bridge-backed harness
settings with konsistent.

## Checklist

- [x] All commits are signed (PRs with unsigned commits cannot be
merged)
- [x] Tests have been added / updated (for bug fixes / features)
- [x] Documentation has been added / updated (for bug fixes / features)
- [x] A _patch_ changeset for relevant packages has been added (for bug
fixes / features - run `pnpm changeset` in the project root)
- [x] I have reviewed this pull request (self-review)