Add the BYO console plane over the OOB serial channel

Part of #1814

## Problem

On a BYO host the serial console is the only channel that keeps working when the kernel is dying —
which makes it the channel that matters most. It arrives over the OOB driver (SoL on x86, vterm on
the HMC) rather than from a local file or a libvirt stream, so the collection, rotation, and
snapshot path has to be wired for a remote, credential-bearing source.

The console is also a **contended resource**: log collection and the KGDB session (#1814 entry 14)
both want the same serial channel. This entry owns the collection side and must not close the door
on arbitration.

## Evidence

- `src/kdive/providers/console_parts/rotation.py` and `sidecar.py` — the shared rotation/sidecar
parts both existing providers reuse.
- `src/kdive/providers/remote_libvirt/console/collector.py` — the remote console collector
precedent, with `wiring.py` and `snapshot.py` alongside it (ADR-0095).
- `src/kdive/providers/core/runtime.py:110` — `ConsoleCapabilities`, whose `reader_factory` is a
lazy factory precisely so composition stays buildable without S3 config (ADR-0076).
- All console output passes the redactor before persistence or any response snippet
(`src/kdive/security/`) — non-negotiable, and more pointed here because OOB credentials are
username/password.
- Related prior work under epic #1760: #1775 (x86 Redfish/IPMI SoL artifacts) and #1776 (HMC
vterm artifacts) cover this surface from the MAAS-premise side, and #1774 covers serial endpoint
leasing. See #1814's overlap table — do not work an overlapping pair in parallel.

## Expected outcome

- Console collection from the OOB channel, wired through `ConsoleCapabilities` with rotation and
snapshot, reusing `console_parts` rather than duplicating them.
- Redaction applied before persistence, with a test that proves an OOB credential appearing in
console output does not reach the store.
- The channel-ownership model is at least *stated* here, even though #1814 open question 3 is
resolved in #1815 — whether KGDB takes exclusive ownership or the stream is demultiplexed decides
whether `supports_crash_watch` can be advertised unconditionally.
- Console evidence available on the install/boot failure path (#1814 entry 10 depends on it).

Blocked by #1818
Blocked by #1823

Start with src/kdive/providers/remote_libvirt/console/collector.py, wiring.py, and snapshot.py, then read the shared rotation and sidecar parts and ConsoleCapabilities in src/kdive/providers/core/runtime.py:110. Check the dependency and overlap issues before proceeding. Done means the OOB console is wired through the capability with rotation, snapshots, redaction coverage, and a stated channel-ownership model.

Written by the indexing model from the issue text.