Phase 2 slice 6: Migrate provider credentials and profiles to gRPC

> [!WARNING]
> this issue is pending scoping and should only be picked up by rsliter.

Parent Epic: #9802

## Outcome

Use the main-service gRPC client for gateway provider credentials, profiles, and refresh operations that satisfy the Phase 1 provider contract.

## Draft scope

- Map released provider create, get, list, update, and delete RPCs to NemoClaw-owned types.
- Map released provider-profile and credential-refresh RPCs used by current onboarding, recovery, rebuild, and credential actions.
- Preserve local credential discovery, environment validation, and request assembly inside NemoClaw.
- Keep provider credentials in the existing gateway credential boundary.
- Map gRPC authorization, validation, conflict, missing-resource, and transport results to typed domain errors.
- Run shared provider-management contracts against CLI and gRPC implementations.

## Acceptance evidence

- Create, update, list, get, refresh, and delete decisions match the Phase 1 contract.
- Missing, malformed, conflicting, wrong-scope, and authentication-failed requests remain distinct.
- Provider credentials do not enter process arguments, logs, errors, artifacts, or typed results.
- A timed-out mutation re-reads provider state before any retry or cleanup.
- Delete refuses to continue when attachment or ownership state does not satisfy the current cleanup contract.

## Test plan

- Shared CLI and gRPC provider-management contracts.
- gRPC request, scope, status, timeout, cancellation, and redaction tests.
- Existing credential, onboarding, provider-profile, recovery, rebuild, and cleanup tests.
- Focused live evidence for credential custody, authorization scopes, rotation, and deletion.

## Dependencies and sequencing

Blocked by Phase 2 Slice 1.

## Deferred scope

- Sandbox provider attachment operations.
- New provider types or credential sources.
- Deletion of CLI provider methods until the closure slice.