feat(core): add external credential references

[rekram1-node]

Summary

• Add a generic external credential value containing a method ID and optional metadata, without fake keys or OAuth tokens.
• Expose external records through the existing credential store and connection views; pass metadata as provider settings, not token material or request-body data.
• Make existing key/OAuth-only consumers explicitly handle the new union member. Azure, GitLab, and OpenCode Console authentication behavior is otherwise unchanged.
• Regenerate the client credential and connection types.

Scope

This is the storage/runtime foundation only. It adds no cloud setup wizard, authentication discovery polling, or new dependencies.

Verification

• bun run check passed on this layer independently.
• 90 existing Core tests passed across credentials, integrations, model resolution, and catalog.

First PR in the External → Form fixes → Bedrock stack.