Add scoped service-account credential storage for unattended managed agents

## Problem

Buzz has no unattended credential mode for managed agents. The only current per-user configuration surface accepts arbitrary environment-variable values, persists them in plaintext JSON, and injects the resulting map into every managed agent process. A 1Password service-account token placed there would be readable by all locally managed agents and remain on disk until manually removed.

This prevents a safe workaround for the macOS 1Password/TCC consent loop tracked in #2783: agents need noninteractive access to a deliberately narrow 1Password vault, without broadening the token to all agents or copying each resolved secret into a second store.

## Confirmed code path

- `desktop/src-tauri/src/managed_agents/global_config/mod.rs:20-23` documents that global settings are stored in `/agents/global-agent-config.json`; `:196-210` serializes and writes the complete config at mode `0600`.
- `GlobalAgentConfig.env_vars` is documented as applying to **all** managed agents at `:47-50`.
- `desktop/src-tauri/src/managed_agents/runtime.rs:753-757` applies the fully layered `descriptor.env` to every spawned harness after Buzz-owned environment setup.
- `desktop/src-tauri/src/managed_agents/agent_env.rs:3-5` shows the only build-time alternative: arbitrary `KEY=VALUE` values compiled into the desktop binary.

The current source contains no managed-agent secret-store/service-account abstraction or Keychain-backed storage path (search scope: `desktop/src-tauri/src/managed_agents` and `desktop/src/features/agents`, commit `3c7f288c6`).

## Observed impact

On macOS, normal `op` desktop-app authorization repeatedly triggers a TCC consent prompt under Buzz sidecar identities (#2783). A dedicated 1Password service account is the viable unattended alternative, but the existing global env mechanism makes its bearer token ambient to every managed agent.

## Requirements for a solution

- An explicit, advanced unattended mode, disabled by default.
- Store only a service-account bearer token in an OS-backed credential store; do not persist resolved vault values in agent config.
- Bind each credential grant to a named managed agent or persona and make the granted vault/scope, last use, and expiry visible.
- Inject the token only into the selected agent process. Do not expose it through agent-definition events, logs, diagnostics, UI readback, crash reports, or inherited global environment.
- Provide disconnect/revocation guidance and fail closed if the OS credential store cannot be read.
- Keep the 1Password Desktop/TCC repair in #2783 independent: unattended mode is opt-in, not a substitute for fixing repeated interactive consent prompts.

## Classification

Feature request / security boundary. The missing capability is confirmed; 1Password service-account provisioning and final UI wording are product decisions.

Start with desktop/src-tauri/src/managed_agents/global_config/mod.rs, runtime.rs, and agent_env.rs, then trace how configuration is layered into spawned harnesses. Confirm the existing storage and injection boundaries before designing the opt-in credential flow; done means scoped OS-backed storage, visible grant metadata, isolated token injection, safe failure, and revocation guidance without changing #2783.

Written by the indexing model from the issue text.