feat(fleet-tools): mint-seat-credential.sh joins the framework toolkit

Moves seat credential minting out of a brain-local fleet/bin into
packages/mosaic/framework/tools/fleet/, parameterized for any deployment:

- MOSAIC_ADMIN_SEAT (or --admin-seat) names the seat whose admin token calls
  the Gitea admin API; no seat name is hardcoded.
- MOSAIC_GITEA_INSTANCES / MOSAIC_GITEA_URL_<INSTANCE> select and override
  instances, the same convention seat-logins.sh already uses.
- MOSAIC_SEAT_EMAIL_DOMAIN sets the account email domain.
- tea projection calls the sibling seat-logins.sh, not a brain-local copy.

Hermetic suite test-mint-seat-credential.sh (mock curl, sandboxed brain home,
no tea, no network) pins: slot written from the mint response at mode 600;
admin seat must be configured (rc=3) and its token present (rc=1, no API
call); instance selection and URL override; admin token value never echoed.
Joins ci.yml and the verify-release canonical list. Adds tools/fleet/README.md.

Plan: docs/plans/2026-08-21_git-operations-toolkit.md step 6 (first of three
scripts; new-seat.sh and launch-seat.sh need a design ruling, see the plan).

scripts/verify-release.mjs

@@ -63,6 +63,7 @@ export const STAGES = [
       'bash packages/mosaic/framework/tools/git/test-issue-close-fail-closed.sh',
       'bash packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh',
       'bash packages/mosaic/framework/tools/git/test-issue-view-comments.sh',
+      'bash packages/mosaic/framework/tools/fleet/test-mint-seat-credential.sh',
       'bash packages/mosaic/framework/tools/git/test-wrapper-guard.sh',
       'bash packages/mosaic/framework/tools/git/test-mosaic-worktree-large-repo.sh',
     ],