Add Kernel Vault credentials to the Jev agent

[rgarcia]

Summary

• detect and group visible credential forms while redacting browser field values
• let Jev select API-returned vault credentials or create a per-step credential through hosted collection
• fill mapped fields through Kernel Vaults without exposing secret values to either model
• add live public-login smoke coverage and update the prebuilt REPL bundle

Testing

• npm run typecheck
• npm run check:lockfile
• npm test --workspace @onkernel/browser-loop (442 tests)
• npm run typecheck in examples/jev-system-one
• npm test in examples/jev-system-one (31 tests)
• npm run build:repl && npm run check:repl
• npm run smoke:credentials (14 login pages, 3 negative controls)
• live Vault API grouped-fill smoke test with a temporary credential and browser
• live non-vault Example Domain agent smoke test

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit da0849e. Configure here.}