feat(env): add crab env snapshot and crab env restore for machine migration

Adds an agentic environment capture and restore system. `crab env snapshot`
runs a quick prescan of the machine then launches a coding agent to explore
deeply and build a comprehensive recipe. The recipe + configs, secrets, and
DB schemas are encrypted into a portable bundle. `crab env restore` decrypts
and launches an agent in safe mode to set up a new machine from the recipe.

Key design decisions:
- Agentic approach: adapts to any toolset, not hardcoded scripts
- Prescan seeds the agent with concrete findings for completeness
- Recipe is directional guidance (markdown), not literal bash scripts
- Agent-agnostic: uses existing abstraction layer (Claude/Codex)
- Snapshot uses autonomous mode; restore uses safe/interactive mode
- Encryption via openssl aes-256-cbc with pbkdf2 (cross-compatible)

Validated end-to-end on a clean macOS Sequoia VM (Tart) with Codex as the
restore agent — all phases completed autonomously.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: MrFlounder