Gate env-delivered org credentials by service-cred grants (#548)

* Gate env-delivered org credentials by service-cred grants

Env-delivery credentials previously injected into every all-internal
conversation with no access gate. They now ride only when every internal
participant is entitled through the same service-cred ACL grants that
already gate the broker (org-wide, personal:, or team: grantees).

- orchestrator: env injection checks grantsOfKind("service-cred") with
  principalEntitledToScope, same audience semantics as the broker token
- admin route: person/team grantees are now accepted for env creds
  (the 400 rejection is removed)
- tests: existing env-provision tests grant org-wide; new test proves
  no grant = no env var, someone-else's grant = no env var, actor's
  personal grant = env var rides

Back-compat: every credential saved through the admin route already
carries an org grant by default, so existing env creds keep working.
Admin UI picker for people/teams is a separate follow-up.

* Fold duplicate service-cred lookups into one shared read per turn

The env gate and the broker token mint each read the org credential list
and scanned grants. One read now feeds both. No behavior change: the
broker path filters the shared grant set by enabled non-env slugs exactly
as before.