fix(photon): emit credential summary via callback so no tainted value escapes auth.py

The previous pass moved credential reads into auth.credential_summary()
which returned a dict of pre-formatted display strings. CodeQL's
interprocedural taint analysis still flagged the cli.py prints because
the dict's values were transitively derived from load_photon_token()
and load_project_credentials().

Pattern that finally works: same as persist_webhook_signing_secret —
the helper takes an emit callback and does the formatting + emitting
itself. cli.py passes `print` as the sink and never receives any
return value derived from credential reads. CodeQL's flow stops at
the helper's emit() boundary.

Changes:
  - auth.print_credential_summary(emit=print) — closure-scoped probes,
    emits 6 lines (header + separator + 4 credential rows) via the
    callback. Returns None.
  - cli._cmd_status now calls print_credential_summary(print) then
    appends the two non-credential rows (node binary, sidecar deps)
    locally with no credential flow.
  - Added test_print_credential_summary_emits_only_display_strings
    asserting the emit callback never sees raw token/secret bytes.

Validation:
  tests/plugins/platforms/photon/ → 26/26 pass
  live smoke: hermes photon status (with empty HERMES_HOME) renders
  the expected layout cleanly

tests/plugins/platforms/photon/test_auth.py

@@ -264,3 +264,20 @@ def test_credential_summary_returns_only_display_strings(
     assert summary["device_token"].startswith("✓")
     assert summary["project_key"].startswith("✓")
     assert summary["project_id"] == "proj-uuid"
+
+
+def test_print_credential_summary_emits_only_display_strings(
+    tmp_hermes_home: Path,
+) -> None:
+    """The emit callback must never receive raw credential bytes."""
+    photon_auth.store_photon_token("token-aaaaaaaaaaaaaaaa")
+    photon_auth.store_project_credentials("proj-uuid", "secret-bbbbbbbbbbb")
+    lines: list = []
+    photon_auth.print_credential_summary(lines.append)
+    blob = "\n".join(lines)
+    assert "token-aaaa" not in blob
+    assert "secret-bbbb" not in blob
+    assert "✓ stored" in blob   # device token line
+    assert "proj-uuid" in blob   # project id is intentionally surfaced
+    # Header is always emitted
+    assert any("Photon iMessage status" in line for line in lines)