[TheGreatAxios]

Summary

• Deletes packages/credential-providers (Workbench-owned CredentialProvider plugins) and moves the two non-Manus schemes into two new public libraries: @corbits/credential-header (x-api-key, raw Authorization, any header — one createHeaderCredentialProvider factory plus xApiKeyCredentialProvider/rawAuthorizationCredentialProvider presets) and @corbits/credential-mcp (MCP streamable-HTTP provider + origin-pinning helpers). Manus is dropped entirely, along with tools/manus.
• Registers both natively in the sidecar: apps/sidecar/src/workflow-substrate-factory.ts's createCredentialProviderRegistry now includes xApiKeyCredentialProvider(), rawAuthorizationCredentialProvider(), and createMcpStreamableHttpCredentialProvider() alongside builtinCredentialProviders(). apps/sidecar/package.json pins both packages at their pushed SHAs; VENDORED.md's apps/sidecar row now notes this one registration delta from upstream.
• tools/granola and tools/linear drop their @corbits/credential-providers dependency; their fake-credential unit test comments now point at @corbits/credential-header. Deleted the DB-gated e2e tests that exercised deriveResolvedBindings/the raw-authorization provider directly (that derivation didn't move to either new package).
• Rebased onto main after feat(hub,web)!: delete @corbits/connections and every connect/MCP/provider-health surface built on it (CL-8327) #834/chore(fmt): format files touched by the connections rebase (CL-8327) #835 deleted packages/connections, apps/hub/src/native-connector-registry.ts, and tools/mcp; those deletions won over this branch's now-moot repoint edits to the same files.

Test plan

• bun install
• bun run typecheck
• bun run lint (pre-existing unrelated warnings only)
• bun run fmt
• bun test tools/granola tools/linear (30 pass, 8 skip — DB-gated, no DATABASE_URL locally)
• bun test apps/sidecar (266 pass)

[linear-code]

CL-8339