feat(generate): scaffold provider profile skeletons for unmapped credentials - #30

What and why

Three of five tested projects needed a hand-written custom provider profile, and providers.sh only said # UNMAPPED ... write a custom profile.

• generate --scaffold-profiles DIR writes DIR/<id>.yaml for every unmapped credential (id = env var lower-cased with hyphens): the credential, plus endpoints, access and binaries taken from the egress directives in the file that declares the credential. tls=skip endpoints get allow_uninspected_credentials: true (OpenShell's profile lint requires it for L4-only credentialed endpoints); credentials with no egress in their file get endpoints: [] and TODO comments. Existing files are kept, nothing is written without the flag, no secret values are involved. The UNMAPPED comment in providers.sh now points to the flag.
• Misleading duplicate warning: egress X duplicates an endpoint the profile adds is now only shown when the profile's binaries overlap the rule's binaries (profile bound to gh/git, app is node: the explicit rule is needed, no warning). Profiles that list no binaries keep the old behaviour.
• README section "Credentials with no provider profile"; CLI.md regenerated.

Checked with the real tool: skeletons generated from anthropic-proxy-rs's sidecar (tls=skip case) and synthetic cases all pass openshell provider profile lint -f (OpenShell 0.1.6 on the dev server). CI cannot run that, so the tests reload the skeletons with our own profile loader.

Tests: tests/scaffold_profiles.rs (3 tests) and a unit test. TOOLCHAIN=1.94 scripts/ci-local.sh and stable clippy pass.

Ordering: independent (new module scaffold.rs; small edits in providers.rs, generate.rs, main.rs's Generate arm). Another PR (#26) edits other parts of main.rs, and #21/#25 edit do_scan; any of them may need a trivial rebase.

Closes #13