feat(auth): expose token credential command

[joaopcm1996]

What does this PR do?

Makes pup auth token available in native release builds as an explicit credential command for programs that need a short-lived Datadog bearer token on stdout.

The command keeps Pup's existing authentication behavior: DD_ACCESS_TOKEN takes precedence, stored OAuth sessions are selected by site/org, and expired access tokens are refreshed during config loading. It emits only the access token plus a trailing newline on stdout; refresh diagnostics and errors stay on stderr. It never exposes refresh tokens or API/application keys.

To keep this credential export intentional, the command is:

• available only in native macOS, Linux, and Windows builds, not WASM;
• visible in normal human help and generated shell completions;
• omitted from full, compact, and scoped AI-agent command schemas.

The PR also documents the narrow security-policy exception and adds unit and release-binary smoke coverage.

Motivation

Trajectory is an OpenAI-compatible local proxy that needs pull-based, command-backed OAuth so it can retrieve and refresh a user's AI Gateway bearer token while it remains running. A Trajectory auth provider can invoke pup auth token on demand, without reading Pup's private keychain/file representation or reimplementing OAuth refresh.

Pup extensions do not cover this boundary: auth forwarding is available only to a child process launched by Pup, and an inherited DD_ACCESS_TOKEN cannot be updated inside an already-running Trajectory proxy. Repeated refresh through extensions would therefore require a nested Pup-launched helper process. pup api also cannot authenticate an arbitrary OpenAI-compatible streaming proxy's upstream requests.

This is the concrete integration gap behind the earlier proposal in #348. Unlike a general-purpose token display feature, this PR defines a narrow credential-command contract and deliberately does not advertise it through Pup's AI-agent schemas.

Additional Notes

Local validation:

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test -- --test-threads=1 — 1,912 passed
• cargo build --release plus exact stdout/stderr, missing-credential, help, completion, and schema smoke checks
• cargo check --target wasm32-wasip2 --no-default-features --features wasi
• git diff --check

cargo audit was also run. It reports pre-existing advisories in the unchanged lockfile (h2 and two rsa versions; the rsa advisory has no fixed release). This PR adds or updates no dependencies.

Checklist

• The code change follows the project conventions (see CONTRIBUTING.md)
• Tests have been added/updated (if applicable)
• Documentation has been updated (if applicable)
• All CI checks pass
• Code coverage is maintained or improved

Related Issues

Related context: #348