Replace PaperSecret bridge with generated SDK

[c1-squire-dev]

Summary

• pin github.com/conductorone/conductorone-sdk-go v1.29.0 and regenerate the vendored dependency tree
• replace the temporary raw internal/external PaperSecret create bridge with generated SDK operations and exact generated ML-KEM enum constants
• validate the generated response through GetAgeSuite() before returning a recipient, while preserving authenticated client reuse, context cancellation, retryable downgrade errors, and cone HTTP error mapping
• adapt cone call sites to the generated model field names shipped in v1.29.0
• update x/crypto and go-jose/v4 to the exact releases that clear reachable govulncheck findings

Validation

• go test ./pkg/client ./cmd/cone
• go test ./...
• go test -race ./pkg/client ./cmd/cone
• go test -count=100 -run 'Test(CreateSecret|RequirePaperSecretAgeSuite)' ./pkg/client
• make lint (includes gosec)
• make build
• go mod verify
• dependency/vendor second-pass fixpoint: identical diff SHA-256 before and after
• govulncheck ./...: 0 reachable vulnerabilities
• no production PaperSecret internal/external endpoint literal or raw create call remains
• source diff credential-pattern and whitespace audits pass

The canonical v1.29.0 vendored RELEASES.md contains one upstream Markdown hard-break with trailing spaces; the source-only whitespace audit is clean and re-vendoring reproduces the upstream file exactly.

Closes #147.

Related:

• https://github.com/ductone/c1/pull/21494
• chore: 🐝 Update SDK - Generate 1.29.0 conductorone-sdk-go#116
• https://github.com/ConductorOne/conductorone-sdk-go/releases/tag/v1.29.0

This PR must remain unmerged until independent review is complete.