feat(credentials): YODEL_ROLE picks the role, YODEL_CREDENTIALS still read (#268)

[lex00]

Closes #268

YODEL_CREDENTIALS holds a role, never a credential. yodel now reads YODEL_ROLE for it: writer (every environment) or writer:<env> (that one), else the reader.

• roleSetting in src/credentials.ts reads YODEL_ROLE, then YODEL_CREDENTIALS, and throws when both are set to different values. roleOf uses it, so projects that call credentials() from chant.config.ts read the new name with no edits.
• The refusals name the variable that is set and print YODEL_ROLE=writer:<env> to run again. yodel config shows which of the two set the role.
• Tests for the alias, the conflict and the refusal under the older name. The approval claim expects the new refusal text.

The rendered CI, the templates and the docs keep YODEL_CREDENTIALS here: the templates job checks them against the published yodel, and docs naming YODEL_ROLE would mislead anyone on 0.9.0. They move in the release pull request, #271.