fix(tools/_lib): add /etc/mosaic host-level fallback to credential resolution

Under HOME-redirected profile environments (e.g. Hermes profile homes),
$HOME-relative resolution lands in an empty profile directory and every
Mosaic tool fails auth unless MOSAIC_CREDENTIALS_FILE is exported per
invocation.

Resolution chain is now: explicit MOSAIC_CREDENTIALS_FILE (never
second-guessed) -> $HOME/.config/mosaic/credentials.json ->
/etc/mosaic/credentials.json. The resolved path is exported so sourcing
scripts (stack-health.sh) and subprocesses inherit it; the inline site
in detect-platform.sh gets the same chain.

Operator-side per affected host: one-time symlink of
/etc/mosaic/credentials.json to the canonical file. No operator-specific
paths enter the framework.

Closes #699

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RMoEx7hfdFGjUiCHuN1RRi

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -86,7 +86,12 @@ gitea_url_matches_host() {
 
 get_gitea_service_for_host() {
     local host="$1"
-    local cred_file="${MOSAIC_CREDENTIALS_FILE:-$HOME/.config/mosaic/credentials.json}"
+    local cred_file="${MOSAIC_CREDENTIALS_FILE:-}"
+    if [[ -z "$cred_file" ]]; then
+        # Same resolution chain as _lib/credentials.sh: profile HOME, then host-level.
+        cred_file="$HOME/.config/mosaic/credentials.json"
+        [[ -f "$cred_file" ]] || cred_file="/etc/mosaic/credentials.json"
+    fi
 
     case "$host" in
         git.mosaicstack.dev)