Improve access review non-human credential evidence

[DENGXUELIN]

Closes #1688.

Summary

• add a non-human credential and API access review gate to access-review
• require credential-level owner, backup owner, scope, lifecycle, storage, approval, and emergency revocation evidence
• add vulnerable and benign fixtures for stale human-owned automation credentials versus governed credential review

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• added-line ASCII check
• content marker check for AR-NHI-* findings and fixtures
• git merge-tree --write-tree origin/main HEAD

Bounty

Requested tier: Improver Moderate, USD 100 if accepted.