Picking a model credential returns "none" for a repository whose owner is not a forge admin and has no grant; admin-owned repositories still fall back #2095

Part 1 of #1144 (a person's ask, parked twice). The tries changed every fallback at once, and the suites that rely on the fallback went red (test/credentials.test.ts "a subscription's scope" and "a crew run on the platform's token"). This part narrows the change: the fallback stays for repositories the forge's admins own (that credential is theirs) and goes away for everyone else. No migration is needed.

Done looks like

• [ ] pickSubscription in src/core/subscriptions.ts returns a new { kind: "none" } instead of { kind: "env" } when the scope's owner is not a forge admin and no grant matches. Admin-owned scopes still get env.
• [ ] Callers (src/crew/runner.ts) treat none as env for now, so no run changes behaviour in this pull.
• [ ] Tests in test/credentials.test.ts: an outsider-owned scope with no grant gets none, and gets the subscription once it is granted. An admin-owned scope gets env. Where an existing assertion expects env for a non-admin owner, the test was wrong under the new rule: change it and name each one in the pull.
• [ ] Run bun test test/credentials.test.ts test/subscriptions.test.ts test/subscription-budget.test.ts test/spawn-keys.test.ts and bun x tsc --noEmit, and quote both.

Suggested: ledger.