feat(credentials): configurable phantom format for prefix-sniffing clients

[kipz]

Linked Issue

Closes #1486

Summary

Adds an optional format template to credential phantoms (e.g. "sk-ant-oat01-{}", {} = random 64-hex body) so the visible placeholder follows a literal shape a client can sniff to classify the credential — e.g. pi's apiKey.includes("sk-ant-oat"). The template is stripped on egress before the real credential is substituted, so it never reaches upstream, and the body is always random (no real-token bytes copied). Supported on both oauth_capture response fields (kind: opaque) and ambient command_policies credentials, sharing one PhantomTemplate and one egress-rewrite helper. A format/token-shape mismatch warns but still resolves.

Reviewer note: relaxed nonce guard

This PR removes the is_nonce shape check from resolve_env_entry and resolve_nonce in TokenBroker, so redemption now relies on the map lookup alone. That is correct — map keys are only ever phantoms the broker itself minted, and a templated phantom has no nono_ marker to check for — but it is a security-relevant relaxation, so flagging it explicitly rather than leaving it buried in the diff. Grant-set enforcement is unchanged: every redemption path still checks GrantSet::admits(consumer).

Agent Disclosure (if applicable)

Generated by an AI agent (Claude Code). Reuses the existing credential_format {} convention and the NonceResolver trait; all new logic is original. Confirmed compliant with the repository's coding and security requirements.

Test Plan

• make ci clean (clippy -D warnings -D clippy::unwrap_used, fmt, tests).
• New unit tests cover PhantomTemplate (parse/render/matches/find_in incl. empty-prefix, short/non-hex body, UTF-8 boundary safety), find_bare_nonce, rewrite_first_phantom; OAuth-capture templated round-trip, drift-warn, multi-template, jwt-kind rejection; TokenBroker templated store/issue/env-resolve/scan_and_reissue with consumer gating; profile + command-policy validation.
• Verified end-to-end downstream: a coding agent's Anthropic OAuth login now mints an sk-ant-oat01-<64hex> phantom, is classified as an OAuth bearer, and resolves on egress (previously misrouted to x-api-key → 401 invalid x-api-key).

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

Agent Compliance Check (Required for AI/Automated PRs)

• I am not prohibited from contributing under this policy
• An issue already exists
• I disclosed that I am an agent in the issue discussion
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required
• I validated and canonicalized all relevant paths
• This PR matches the approved or disclosed issue scope

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+1688
Lines removed	-301
Total changed	1989
Classification	Large (> 300 lines)

Affected crates

• crates/nono-proxy — downstream consumers depend on this crate. API or behaviour changes will affect external callers; treat any breaking change with extra scrutiny.
• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Broad

This PR touches: source code,documentation,configuration / policy files

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

1 potential bug; 1 recommendation.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[nogent-nolabs-ai]

Warning

🐛 [MEDIUM · bug] Allowing a PhantomTemplate with an empty prefix and suffix (e.g. "{}") causes any 64-character hex string (such as a commit hash or SHA-256 digest) to match the template. This causes contains_phantom to return true on benign inputs containing hashes, which can lead to unexpected HTTP parsing errors and request rejections in rewrite_form_request_body. Enforce that the template prefix must be non-empty in PhantomTemplate::parse to prevent this.