guide: read-only guided manual-rotation layer (links + worklist + TUI)

Advances the guided-rotation goal without rotating anything.

- internal/links: offline change-password URL generation — curated per-service
  table + RFC 8615 /.well-known/change-password + parent-domain fallback; derives
  a web host from a credential (git/netrc "user @ host", docker registry, aws)
- internal/worklist: secrets-free rotation worklist (source, identity, auto/manual,
  link) + Markdown renderer
- internal/tui: Bubble Tea walk-through (one credential per screen, open link,
  mark done/skip, progress) — READ-ONLY, enters/stores no secret
- cmd: `incredigo worklist` (offline, stdout/--out) and `incredigo guide` (TUI)
- tests: link derivation, worklist build/markdown + no-secret-column, TUI
  navigation/done/quit/view

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -23,10 +23,14 @@ credentials that legitimately require a human. See `docs/ROTATION.md` Part II.
 - **v1 shipped:** discover → migrate → expiry → sealed export/import. 8 scanners
   (aws, env, netrc, ssh, docker, kube, git, file/`--path`); sealers age (default),
   hmac, openssl. Tests green, `-race` clean.
-- **Rotation: design + safety-spine only.** `internal/rotate` has the `Rotator`
-  interface, the **mandatory backup gate** (`Snapshot`), and a dry-run `incredigo
-  rotate`. **Zero rotation drivers exist; `--execute` is refused.** Nothing changes a
-  credential at any service yet — keep it that way until explicitly authorized.
+- **Rotation: design + safety-spine + guided manual layer.** `internal/rotate` has
+  the `Rotator` interface and the **mandatory backup gate** (`Snapshot`); dry-run
+  `incredigo rotate` refuses `--execute`. The guided layer is built and **read-only**:
+  `internal/links` (offline change-password URL generation: curated table + RFC 8615
+  well-known + host fallback), `internal/worklist` (secrets-free worklist), and
+  `internal/tui` (Bubble Tea walk-through) — surfaced as `incredigo worklist` and
+  `incredigo guide`. **Zero rotation drivers exist; nothing changes a credential at
+  any service yet** — keep it that way until explicitly authorized.
 
 ## Hard rules (do not violate — this tool holds real credentials)