fix(tools/_lib): add /etc/mosaic host-level fallback to credential resolution

Under HOME-redirected profile environments (e.g. Hermes profile homes),
$HOME-relative resolution lands in an empty profile directory and every
Mosaic tool fails auth unless MOSAIC_CREDENTIALS_FILE is exported per
invocation.

Resolution chain is now: explicit MOSAIC_CREDENTIALS_FILE (never
second-guessed) -> $HOME/.config/mosaic/credentials.json ->
/etc/mosaic/credentials.json. The resolved path is exported so sourcing
scripts (stack-health.sh) and subprocesses inherit it; the inline site
in detect-platform.sh gets the same chain.

Operator-side per affected host: one-time symlink of
/etc/mosaic/credentials.json to the canonical file. No operator-specific
paths enter the framework.

Closes #699

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RMoEx7hfdFGjUiCHuN1RRi

packages/mosaic/framework/tools/_lib/credentials.sh

@@ -15,13 +15,23 @@
 #
 # After loading, service-specific env vars are exported.
 # Run `load_credentials --help` for details.
+#
+# Resolution order (first match wins):
+#   1. $MOSAIC_CREDENTIALS_FILE (explicit override — never second-guessed)
+#   2. $HOME/.config/mosaic/credentials.json
+#   3. /etc/mosaic/credentials.json (host-level fallback)
+# The /etc fallback exists for HOME-redirected profile environments, where
+# $HOME points at a per-profile directory that has no credentials file.
+# Operators symlink /etc/mosaic/credentials.json to the host's canonical
+# file once, instead of exporting MOSAIC_CREDENTIALS_FILE per invocation.
 
 if [[ -z "${MOSAIC_CREDENTIALS_FILE:-}" ]]; then
-  for _cand in "$HOME/.config/mosaic/credentials.json"; do
+  for _cand in "$HOME/.config/mosaic/credentials.json" "/etc/mosaic/credentials.json"; do
     if [[ -f "$_cand" ]]; then MOSAIC_CREDENTIALS_FILE="$_cand"; break; fi
   done
   : "${MOSAIC_CREDENTIALS_FILE:=$HOME/.config/mosaic/credentials.json}"
 fi
+export MOSAIC_CREDENTIALS_FILE
 
 _mosaic_require_jq() {
   if ! command -v jq &>/dev/null; then