feat(credential-injection): {{credential.X}} 用戶面語法（credential-primitives §8）

壓測 401 根因：{{credential.X}} 系統沒實裝，三條 template 展開路徑都不認
credential. namespace → 注入空值 → 目標 API 401（test_arcrun/5 Haiku 實證）。

修法（design §8，richblack 確認方向 B「讓 {{credential.X}} 真的能用」）：
- auth_static_key 加 resolve_credentials action：給 names → WASM 內 kv_get +
  crypto_decrypt → 回明文 map（不查 recipe、缺則誠實報錯）
- auth-dispatcher 加 resolveCredentialRefs：遞迴偵測 {{credential.X}} → 交 WASM
  解密 → 回填（無 ref 則零開銷不打 WASM）
- graph-executor 在 node.data interpolate 後呼叫，不碰 ENCRYPTION_KEY（rule 02 §2.2）

解密全程在 WASM，TS 只偵測+回填。tinygo build OK + tsc 0 + §2.2 自檢綠。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cypher-executor/src/graph-executor.ts

@@ -2,7 +2,7 @@
 import type { ExecutionGraph, GraphNode, TraceStep, ComponentRunner, KVContextStore, EdgeType, Bindings } from './types';
 import { kvSetNodeOutput, kvGetNodeOutput, ExecutionError, WorkflowPaused } from './types';
 import { injectCredentials } from './actions/credential-injector';
-import { tryAuthDispatch } from './actions/auth-dispatcher';
+import { tryAuthDispatch, resolveCredentialRefs } from './actions/auth-dispatcher';
 import { expandPromptRecipe } from './lib/recipe-expander';
 import { resolveRecipe } from './routes/recipes';
 import { persistPausedRun, isResumablePending, parseRecipeOutput } from './lib/paused-runs';
@@ -245,6 +245,13 @@ export class GraphExecutor {
             ...resolvedData,
           };
 
+          // 用戶面 {{credential.NAME}} 展開（design §8）：偵測 node.data 裡用戶寫的
+          // {{credential.X}} → 交 auth_static_key WASM resolve_credentials 解密回填。
+          // 解密在 WASM（rule 02 §2.2），此處只偵測+回填，不碰 ENCRYPTION_KEY。
+          if (this.env && this.apiKey) {
+            mergedContext = await resolveCredentialRefs(mergedContext, this.env, this.apiKey);
+          }
+
           // Resumable workflow callback_url 注入（SDD: resumable-workflow/design.md §2.2）
           // claude_api 容器拿到後會透傳給 Mira daemon，daemon task 完成時 POST 進來
           // hostname 暫從 PUBLIC_BASE_URL 取，沒設則用 cypher.arcrun.dev 預設