Add credential vault commands and preview CLI binaries

[rgarcia]

summary

• Add credential create/update from bounded file/stdin JSON and collection operations using the pinned Go SDK preview. Share fill execution and strict outcome validation between card and credential items; accept --params or --spec-file, with type-specific field/URL/format validation.
• Make the flow discoverable through vaults, credentials, items, invoke, and browser help. Steer description toward the recognizable site name and usernames/emails toward explicit sensitive: false; document empty-string updates as clears. Preserve readiness/version metadata while omitting stored credential values. Redact credential write errors and disable SDK retries.
• Adapt card PATCH to the typed SDK request without changing provider behavior.
• Build Linux/macOS/Windows amd64/arm64 preview archives and checksums in Actions. No stable release, npm, or Homebrew publication. See PREVIEW.md for download instructions.

preview dependency

Pins the immutable STLC Go preview ea40d26657db27467b038ffdb877ca52e3623097 with a module replacement. The staging repository requires authentication: CI uses a contents-read GitHub App token for module download only, disables module caching, and skips fork jobs. Replace the pin with a released SDK and remove temporary auth before merging or stable publication; the release workflow enforces this.

validation

• make test (vet and all repository tests): pass.
• Vault/credential/browser-binding tests under the race detector: pass.
• Local CLI build and help inspection: pass.
• actionlint for changed workflows and bash syntax validation: pass.
• SDK HTTP contract tests cover typed requests, null and empty-string clearing, collection URLs, both fill input modes/item types, credential fields named expiration, safe outcomes, redaction, and no retries. Subprocess tests verify valid JSON and exit status for credential and card outcomes.
• The CI-built Linux binary at b4a66ce starts and displays the new site-name/sensitivity guidance. All six archive checksums verify. Live browser fill has not been exercised.

try the preview

Download the CI preview binaries (GitHub login required, 14-day retention). Includes Linux/macOS/Windows on amd64 and arm64. Extraction and API configuration instructions are in PREVIEW.md.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f1e6a86. Configure here.}