fix(core): report every CLI that is logged in, not only aws

[Cedric921]

Closes #41.

What this changes

authenticatedClis counted a CLI as logged in only when a found credential's path ended with the path its verb table named. The tables and the scan had drifted apart. With the six files below present, on main:

authenticatedClis(['gcloud','netlify','heroku','aws','psql','mysql'], ...)  ->  aws

With this change, all six. Credentials are the headline of npx memnox, so the scan was under-reporting on most machines.

Four changes, each small:

• A credential matches the file or the directory it sits in. ~/.config/gcloud is where gcloud keeps credentials.db, and ~/.netlify where netlify keeps config.json; a suffix match saw neither. The directory match requires the / boundary, so ~/.netlify does not claim ~/.netlify-old/ — a test pins that.
• Heroku is read from ~/.netrc, where the Heroku CLI writes its token. ~/.heroku holds no credential.
• The scan reads the files the tables named and it did not: .pgpass, .my.cnf, .config/gcloud/application_default_credentials.json and .azure/msal_token_cache.json, as the issue lists.
• A drift test walks every ~ credential in every table and asserts the scan reads that file or a file inside it.

Two things the drift test caught, one of them mine

~/.myclirc and ~/.config/pgcli/config came in with #127, which I wrote. Neither holds a credential — mycli and pgcli authenticate through .my.cnf and .pgpass, which those tables already name — so I took them out rather than teach the scan to report config files as credentials.

And #128, still open, adds a pulumi table naming ~/.pulumi/credentials.json. That is Pulumi's access token, so it belongs in the scan anyway; I added it here so the drift test does not go red the moment #128 lands.

How it was verified

In credentials.test.ts: each of gcloud, netlify, heroku, psql and mysql is reported when its file exists; nothing from those files — the .pgpass password, the .my.cnf password, the .netrc password, the netlify token — appears in what authenticatedClis returns; the sibling-directory negative; and the drift test, one case per table credential.

prettier, tsc and knip clean. Full suite on Node 24: every failing file also fails on main here (the Noise pairing tests, which need the native addon; no Rust on this machine).

Checklist

• pnpm format && pnpm typecheck && pnpm test && pnpm deadcode all pass (Noise tests aside)
• Behaviour change ships with a test
• No any, no magic values, no console.* outside cli-output.ts
• If this touches the decision path: n/a — discovery, not a verdict
• If this changes a verb table: no class moved; the credential field of heroku, mycli and pgcli changed, as above
• If this changes a command, flag or file it writes: scan reports more logged-in CLIs; it reads five more files, structure only, which the changeset names