fix(#1367): mint-seat-credential — secrets out of argv; discriminating pins (review 259 blocker, review 260 SF1-SF3)

Blocker (rev-security-01 review 259): admin token, generated password and
minted seat token travelled curl ARGV (three Authorization sites, -u at
the mint, inline -d bodies), leaking to /proc cmdline and bash -x traces
— the durable password under must_change_password:false is a live
credential. All three now travel in 0600 staging files: --config for the
Authorization header (the landed gitea_write_auth_config pattern), a
user= directive for basic auth at the mint, --data @file for bodies.
Unlinked after each use; M6 asserts no call is unauthenticated and no
body is inline.

Scope pin (SF2 + rev-security-01 M1, same defect): a mutant writing the
REQUESTED scopes passed green because the grep target appears in both
sets. M7 now asserts write:issue (requested, not granted) is ABSENT;
mutant killed.

SF3: hyphenated instance overrides map hyphen->underscore exactly like
seat-logins.sh (url_override_var); M8 pins it; the uppercase-only mutant
dies at the invalid-variable-name refusal again, now by design.

SF1: mint-seat-credential.sh mode 755 (update-index), README invocation
updated to name the now-required MOSAIC_SEAT_EMAIL_DOMAIN.

Framework-PR firewall answer (rev-security-01): the email domain has NO
default — unset is rc=3 with a named variable (M9); the instance host
map stays per the seat-logins.sh precedent already on next. Estate
domains belong to the estate, not the tree.

packages/mosaic/framework/tools/fleet/README.md

@@ -13,11 +13,12 @@ Seat lifecycle tools for a Mosaic fleet. Paths are relative to
 ## Onboarding a seat's credential
 
 ```
-MOSAIC_ADMIN_SEAT=<admin-seat> mint-seat-credential.sh <seat>
+MOSAIC_ADMIN_SEAT=<admin-seat> MOSAIC_SEAT_EMAIL_DOMAIN=<domain> mint-seat-credential.sh <seat>
 ```
 
 - The admin token is read from `$MOSAIC_BRAIN_HOME/fleet/agents/<admin-seat>/secrets/gitea-<instance>-<admin-seat>.token`. It is never printed.
-- Instances default to the map shared with `seat-logins.sh`; `MOSAIC_GITEA_INSTANCES="a b"` limits the set and `MOSAIC_GITEA_URL_<INSTANCE>` overrides a server URL.
+- `MOSAIC_SEAT_EMAIL_DOMAIN` is required (no default): the framework ships no estate-specific domain.
+- Instances default to the map shared with `seat-logins.sh`; `MOSAIC_GITEA_INSTANCES="a b"` limits the set and `MOSAIC_GITEA_URL_<INSTANCE>` overrides a server URL (hyphens in the instance name become underscores in the variable, as in `seat-logins.sh`).
 - The seat slot is written from the mint response: `.token`, `.scopes` (what was granted), `.principal`, each mode 600.
 - `tea` absent is a warning, not a failure: REST-path wrappers work with the token alone.
 - Regression suite: `test-mint-seat-credential.sh` (hermetic, mock curl, no network).