fix(cosh): support credentials encryption in settings.json

[samchu-zsl]

Description

对 settings.json 中的敏感配置项增加安全保护，支持与明文值的向后兼容。

• 新增统一的凭据保护模块，写入时保护、读取时还原
• 统一修改 MCP token storage 的密钥派生方式，兼容本次修改，支持自动迁移

同时修复 pre-commit.js 中 lint-staged 的工作目录指向错误，确保提交前顺利进行 lint/format。

建议进行 rebase 合并。

Related Issue

no-issue: Non-Disclosure Issue

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• agent-sec-core
• os-skills
• agentsight
• Multiple / Project-wide

Checklist

• [ x I have read the Contributing Guide
• My code follows the project's code style
• I have added tests that prove my fix is effective or that my feature works
• I have updated the documentation accordingly
• For cosh: Lint passes, type check passes, and tests pass
• For agent-sec-core (Rust): cargo clippy -- -D warnings and cargo fmt --check pass
• For agent-sec-core (Python): Ruff format and pytest pass
• For os-skills: Skill directory structure is valid and shell scripts pass syntax check
• Lock files are up to date (package-lock.json / Cargo.lock)

Testing

Additional Notes

[CLAassistant]

All committers have signed the CLA.

[kongche-jbw]

lgtm