fix(cli): print join credentials for run --agent ROLE=external

Description

The pitch.

One of nine independent PRs from a correctness audit of `main` at `df0b5f1`. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).

Commits: `a5ef034`, `8ee2a25`, `abe2143`

### Problem

The README says `run --agent ROLE=external` hands out join credentials. It
printed none, so the run timed out INCOMPLETE. Separately, `test-agent --wait`
didn't flush, so through a pipe (CI, `tee`) the credentials appeared only after
the run ended.

### Change

- Both commands use one shared, flushed credential printer.
- Values are `shlex.quote`d, so paths with spaces and grant JSON can be pasted
  into a shell safely. A unit test round-trips them through `shlex.split`.
- The tests live in `tests/test_external_credentials.py`. On failure they
  interrupt the CLI before killing it, so no coordinator is orphaned.
- The README now says a pinned role gets `TOWN_GRANT` in addition to `TOKEN`,
  and that the town refuses the token for a pinned role.

### Compatibility

- The same variables are printed.
- Tokens, loopback URLs and ordinary paths print exactly as before.
- `run_town` is unchanged.

### Verification

- Full suite on the branch: 820 passed, twice.
- A subprocess test reads the CLI's piped stdout. The credentials must appear
  while the run is still waiting; the reference seller then joins from them and
  the run passes. The test fails on `df0b5f1`.
- A real shell paste under both `bash` and `zsh` works with `--identity` and a
  path containing a space.

🤖 Generated with [Claude Code](https://claude.com/claude-code)