[codex] fix registry manifest and auth secret handling

[rudijetson]

Summary

Fixes registry/CLI integration mismatches found while setting up the local learnrudi/cli + learnrudi/registry workflow.

• Fix generated package manifest discovery for binary packages by mapping binary to binaries instead of binarys.
• Support registry binary manifest shapes that use bins and command maps.
• Refresh generated src/packages-manifest.json and dist/packages-manifest.json; binary count now generates as 24 instead of 0.
• Fix search output heading from BINARYS to BINARIES.
• Pass stack-required secrets into rudi auth subprocesses so stack auth scripts can consume RUDI secrets.
• Refresh pnpm-lock.yaml to match the existing packages/runner/package.json dependencies.

Why

The local CLI/registry setup worked for live registry search, but bundled manifest generation missed every binary because it pluralized binary as binarys. Google Workspace auth also declared GOOGLE_CREDENTIALS as a required secret, but rudi auth was not forwarding stack secrets into the auth process.

Validation

• npx --yes pnpm@9.15.9 exec node --test src/__tests__/unit/generate-manifest-contract.test.js src/__tests__/unit/auth-command-execution.test.js
• npx --yes pnpm@9.15.9 run build
• /Users/admin/RUDI/rudi-local search ffmpeg --fresh