feat(fleet-tools): mint-seat-credential.sh joins the framework toolkit

Moves seat credential minting out of a brain-local fleet/bin into
packages/mosaic/framework/tools/fleet/, parameterized for any deployment:

- MOSAIC_ADMIN_SEAT (or --admin-seat) names the seat whose admin token calls
  the Gitea admin API; no seat name is hardcoded.
- MOSAIC_GITEA_INSTANCES / MOSAIC_GITEA_URL_<INSTANCE> select and override
  instances, the same convention seat-logins.sh already uses.
- MOSAIC_SEAT_EMAIL_DOMAIN sets the account email domain.
- tea projection calls the sibling seat-logins.sh, not a brain-local copy.

Hermetic suite test-mint-seat-credential.sh (mock curl, sandboxed brain home,
no tea, no network) pins: slot written from the mint response at mode 600;
admin seat must be configured (rc=3) and its token present (rc=1, no API
call); instance selection and URL override; admin token value never echoed.
Joins ci.yml and the verify-release canonical list. Adds tools/fleet/README.md.

Plan: docs/plans/2026-08-21_git-operations-toolkit.md step 6 (first of three
scripts; new-seat.sh and launch-seat.sh need a design ruling, see the plan).

.woodpecker/ci.yml

@@ -100,6 +100,11 @@ steps:
       # repo. Pins that comment BODIES render on both paths and that a tea
       # failure is named as what it was (git-config vs credential).
       - bash packages/mosaic/framework/tools/git/test-issue-view-comments.sh
+      # Hermetic regression for mint-seat-credential.sh (fleet onboarding moved into
+      # the framework): mock curl, sandboxed brain home, no tea, no network. Pins
+      # that the admin seat is configured rather than hardcoded and that the seat
+      # slot is written from the mint response at mode 600.
+      - bash packages/mosaic/framework/tools/fleet/test-mint-seat-credential.sh
       # Hermetic behavioural regression for the PreToolUse wrapper guard: proves
       # it still blocks the three mistakes AND still lets reads, unwrapped
       # endpoints and ordinary commands through. Both directions are asserted —