fix(webui): pack preview reads credential lines as {service, scope} objects (#1873 SP6)

The bus sends each hire's credential lines as {service, scope} (scope absent
when a definition names a service without scopes). The picker destructured
them as tuples, so a real preview threw and never rendered. The browser test
fixture now uses the producer's shape.

packages/webui/src/public/packs.js

@@ -67,7 +67,7 @@
         ? `<p>Flagged lines, which only the owner approves:</p><ul data-pack-flagged>${h.flagged.map(l => `<li><code>${esc(l.field)}</code> ${esc(l.value)} <span class="muted">${(l.reasons || []).map(r => r === 'above-chief' ? 'above the chief' : r === 'resolve-right' ? 'a resolve right' : r).map(esc).join(', ')}</span></li>`).join('')}</ul>`
         : '<p class="note">No flagged lines.</p>';
     const creds = Array.isArray(h.credentialLines) && h.credentialLines.length
-      ? `<p>Credential lines:</p><ul data-pack-credentials>${h.credentialLines.map(([service, scope]) => `<li><code>${esc(service)}</code> ${esc(scope)}</li>`).join('')}</ul>`
+      ? `<p>Credential lines:</p><ul data-pack-credentials>${h.credentialLines.map(l => `<li><code>${esc(l?.service)}</code>${l?.scope === undefined ? '' : ` ${esc(l.scope)}`}</li>`).join('')}</ul>`
       : '<p class="note">No credential lines.</p>';
     const mark = h.mark === 'dropped' ? 'Not proposed: an agent or open hire decision already has this name.' : 'Recorded on apply for the chief to raise as a hire decision.';
     const noHire = h.noHire ? '<p class="pack-nohire" data-pack-nohire>On this organization\'s no-hire list: the decision will say so.</p>' : '';

packages/webui/tests/packs-workflows-browser.test.mjs

@@ -28,7 +28,7 @@ const PREVIEW = {
     { item: 'workflow', name: 'ship', target: 'ship', path: 'workflows.ship', mark: 'removed' },
   ],
   hires: [
-    { name: 'lead-reviewer', definition: 'org:reviewer', mark: 'propose', pin: null, flagged: [{ field: 'authority.withinRole', value: 'decision.resolve.technical', reasons: ['above-chief', 'resolve-right'] }], credentialLines: [['gitea', 'repo:write']], noHire: true },
+    { name: 'lead-reviewer', definition: 'org:reviewer', mark: 'propose', pin: null, flagged: [{ field: 'authority.withinRole', value: 'decision.resolve.technical', reasons: ['above-chief', 'resolve-right'] }], credentialLines: [{ service: 'gitea', scope: 'repo:write' }, { service: 'matrix' }], noHire: true },
     { name: 'builder', definition: 'coder', mark: 'dropped', pin: null, flagged: null, credentialLines: [], noHire: false },
   ],
   skills: { notEnabled: ['lint-fix'] }, chief: true, plan: {}, digest: REV('d'),
@@ -106,7 +106,9 @@ test('SP6 pack picker: list, preview with marks, flagged, credential and noHire
   ]);
   const lead = '[data-pack-hire="lead-reviewer"]';
   assert.match(await b.evaluate(`document.querySelector('${lead} [data-pack-flagged]').textContent`), /authority\.withinRole decision\.resolve\.technical above the chief, a resolve right/);
-  assert.equal(await b.evaluate(`document.querySelector('${lead} [data-pack-credentials]').textContent`), 'gitea repo:write');
+  // The bus sends each credential line as {service, scope} (hire-decisions credentialLines); scope is absent
+  // when the definition names a service without scopes.
+  assert.deepEqual(await b.evaluate(`[...document.querySelectorAll('${lead} [data-pack-credentials] li')].map(l=>l.textContent)`), ['gitea repo:write', 'matrix']);
   assert.match(await b.evaluate(`document.querySelector('${lead} [data-pack-nohire]').textContent`), /no-hire list/);
   assert.equal(await b.evaluate(`document.querySelector('[data-pack-hire="builder"] [data-pack-nohire]')`), null);
   assert.ok(await b.evaluate(`document.querySelector('[data-pack-hire="builder"] [data-pack-noflag]')!==null`));