auth-role-presence-watch: dry-run policy_write carries source and body; approve state-hub summary tolerates non-KV CCRs

The founder's applier-dry-run of CCR-2026-0064 crashed (KeyError 'source') in render_applier_dry_run.
New test renders the dry run and the apply plan through the CLI. The --record-state-hub summary of
approve no longer assumes openbao.fields, which lane CCRs without a KV path do not have.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

scripts/credential-change.py

@@ -2304,7 +2304,7 @@ def command_decision(args: argparse.Namespace, status: str) -> int:
                 "summary": (
                     f"CCR {ccr['id']} decision {status} by {args.reviewer}: "
                     f"path={openbao.get('kv_path', '-')} policy={openbao['policy_name']} "
-                    f"fields={','.join(openbao['fields'])} "
+                    f"fields={','.join(openbao.get('fields') or []) or '-'} "
                     f"auth_role=auth/{auth['mount']}/role/{auth['role']}; "
                     f"{args.comment}"
                 ),