[araujof]

Description

Out-of-process hosts (Go, C) can run delegate() but never receive the token it mints: raw_credentials is skip-serialized, so a host can only forward the caller's own bearer or fail.

Changes

This adds an opt-in that returns minted credentials on allowed results:

• C: cpex_apl_install flag CPEX_APL_EXPOSE_DELEGATED_CREDENTIALS (2).
• Go: WithDelegatedCredentials(); results carry PipelineResult.DelegatedCredentials (header, value with scheme prefix, delegator, target, audience, scopes, expiry).
• Values are a SecretValue that prints, marshals and logs as [REDACTED]; Reveal() returns the token. Rust Debug redacts too.
• Off by default; nothing is returned on deny. Empty tokens are dropped.
• Additive, so the ABI stays at 3. A library without the flag rejects it with ErrCpexInvalidInput instead of silently returning nothing.

Not covered: Python bindings.

Tests

Tests: FFI unit tests for the flag and redaction; the Go acceptance test asserts no credential without the opt-in, one Authorization: Bearer <minted> with it, and none on deny. Verified end to end from cortex against a local build.

[terylt]

LGTM