fix(agents): drop the blanket credential prompt that blocked owner-authorized logins (#143238)

* fix(agents): drop the blanket credential prompt contract

Blanket transcript credential guidance obstructed owner-authorized browser
fills and workspace credential use. Embedded/local sessions also lacked the
OpenClaw and Gateway tools needed to reach the suggested masked handoff.

Remove the shared prompt builder from core, Codex, Copilot, the system agent,
and the SDK. Keep egress guidance with the secrets tool description, add
scoped masked-setup routing to setup tools, and direct sessions without
control tools to masked terminal setup. Update browser login and SDK
migration docs and regenerate prompt fixtures.

Replace obsolete contract-text assertions with a capability-routing test
that fails on the original missing terminal handoff. Preserve protected
secret entry, transcript redaction, and browser tool behavior.

Thanks @ejc3 for the reachability analysis in #128077 and @Stephane-fci for
the workspace-credential report in #142010.

Refs #120728 #120656 #128076 #128077 #142010

* fix(agents): keep the shipped credential prompt export with narrowed guidance

Keep buildCredentialSafetyPrompt under its shipped SDK name for the
compatibility window. Accept and ignore the deprecated string argument
through 2026-11-30 while callers move to the controlToolsAvailable options
object, with the window recorded in the compatibility registry and docs.

Preserve the private login-code handoff from #139196. Add the terminal setup
route only when control tools are unavailable, and carry that decision
through core, Codex, and Copilot prompts. Keep the terminal line in one
shared owner and regenerate the prompt fixtures.

Restore the unchanged public surface counts of 4,447 exports and 2,629
callable exports without editing budgets or their tests.

* test(agents): restore transport API after model endpoint tests

The Arcee endpoint fixture loads a second transport graph through Jiti and
replaces the shared worker's Responses test API. Restore its original
property descriptor after the file so later schema contract tests use the
Vite graph's configured host.

Reproduced the three strict-flag failures in the CI shard and in an ordered
polluter/victim pair. The repaired shard passes 8,495 tests; both file orders
pass all nine tests and the standalone schema contract passes all four.

Related: #143238