feat(contract): type registry credential Secrets

[ZhiXiao-Lin]

Summary

• add a provider-neutral registry credential Secret target
• keep the wire name closed as registry_credential
• reject duplicate registry credential targets through the existing target uniqueness invariant
• update the Runtime contract test plan

Validation

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --locked contract::
• cargo clippy --workspace --all-targets --locked -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --locked

The complete local macOS suite reaches an existing Unix-domain-socket path-length failure in state_fs_002; the changed contract tests pass and CI remains the Linux full-suite authority.