fix(workplans): portable key-cape path in NK-WP-0003-T08; add /creds-init skill

- NK-WP-0003 T08: replace hardcoded /home/worsch/key-cape with
  $(git rev-parse --show-toplevel)/../key-cape so acceptance tests
  run correctly on any machine
- NK-WP-0005 T04: create .claude/commands/creds-init.md — the
  autonomous credential bootstrap skill (reads creds-state.yaml,
  resumes from current phase, honours emergency bundle gate)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/NK-WP-0003-keycape-privacyidea-cluster-deployment.md

@@ -256,7 +256,7 @@ Prove the full auth flow works:
 
 Use the KeyCape acceptance test suite:
 ```bash
-cd /home/worsch/key-cape
+cd "$(git rev-parse --show-toplevel)/../key-cape"
 go test ./tests/... -run TestProfileBaseline -v
 ```