feat(env): add crab env snapshot/restore for machine migration (#57)

## Summary

- Adds `crab env snapshot` — launches an AI agent to explore the
machine, build a comprehensive setup recipe, capture configs/secrets/DB
schemas, and encrypt everything into a portable bundle
- Adds `crab env restore --from <file>` — decrypts the bundle and
launches an agent in safe mode to set up a new machine from the recipe
- Adds `get_agent_safe_cmd()` helper for non-autonomous agent invocation
- Uses existing agent abstraction layer so both Claude and Codex work as
the snapshot/restore agent

### Design

The agentic approach means no hardcoded collection scripts — the agent
adapts to whatever toolset is on the machine. A quick bash prescan seeds
the agent with concrete findings (brew packages, node versions, git
repos, .env files, etc.) so it knows what to look for. The primary
artifact is `recipe.md` — directional guidance for another agent, not
literal scripts.

### Tested

Validated end-to-end on a clean macOS Sequoia VM (Tart):
1. Ran `crab env snapshot` on source machine → 53 files captured (16
configs, 9 DB schemas, 21 secret mappings, recipe, inventory)
2. Transferred encrypted bundle to fresh VM
3. Ran Codex as the restore agent → autonomously installed brew tools,
nvm + 3 Node versions, oh-my-zsh, restored git/ghostty/claude configs,
created directory structure

## Test plan

- [ ] Run `crab env snapshot --dry-run` to verify prescan output
- [ ] Run `crab env snapshot` end-to-end, verify recipe.md and encrypted
bundle
- [ ] Run `crab env restore --from <file>` on a clean machine or VM
- [ ] Verify agent-agnostic: test with both `agent: claude` and `agent:
codex` config

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: MrFlounder