fix(supervisor): opt-out for persisting provider creds in service file

[eric-jones]

Summary

Adds an opt-out env var, GC_SUPERVISOR_OMIT_PROVIDER_CREDS. When set to "1"
at the time the supervisor service file is generated, provider-credential env
vars (ANTHROPIC_*, GEMINI_*, GOOGLE_*, OPENAI_*) are excluded from the
generated launchd plist / systemd unit. Default behavior is unchanged.

Background — provider creds are persisted in plaintext (mode 0600) into the
service file by design (#1198) so launchd/systemd-spawned supervisors can
deliver creds to agent sessions. The opt-out gives users who'd prefer to avoid
the on-disk plaintext (Time Machine backup posture, crash dumps, regression
surface) a way to disable persistence and deliver creds to the supervisor by
another mechanism (e.g. a wrapper around gc supervisor run).

This is the smallest concrete proposal in #1786; happy to take a different
direction if preferred (e.g. credentials-file loading at supervisor start,
Keychain).

Testing

• make check — passes locally except for documented pre-existing
  failures on origin/main (none related to this change):
  • TestBuiltinDoltDoctorBoundsVersionProbe — fixed by fix(macos): unblock pre-commit hook on macOS dev machines #1729 (open)
  • TestBuiltinDoltDoctorReportsTimedOutVersionProbe — fixed by fix(macos): unblock pre-commit hook on macOS dev machines #1729 (open)
  • TestExecCommandRunnerTimeoutKillsChildProcess — fixed by fix(macos): unblock pre-commit hook on macOS dev machines #1729 (open)
• make check-docs — no docs touched
• make test-integration — not run
• go test ./cmd/gc -run 'TestBuildSupervisorServiceData' -count=1 — green,
  including the new TestBuildSupervisorServiceDataOmitsProviderEnvWhenOptedOut

Checklist

• Linked an issue: Provider credentials in supervisor plist — opt-out path? (follow-up to #1198) #1786
• Added tests for behavior change
• Updated docs — no user-facing docs changed; the opt-out is documented
  inline at the const declaration
• No breaking changes; default behavior is unchanged

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!