Avoid password-change notices on unchanged startup

[shiny-code-app]

Ordinary runtime restarts rewrote the configured administrator password even when it already matched. Odoo 19 sends a password-change security email on every password write, so enabling SMTP exposed repeated notices and bounces from preview refreshes.

Verify the password through Odoo's credential API before writing it. Unchanged credentials remain untouched; a configured rotation retains Odoo's normal write and notification path. Unexpected verification errors stop startup. Preserve quotes and backslashes when embedding the configured credential in the startup shell. Replaces the old script-text assertion with behavioral repeat-startup, rotation, missing-user and failure coverage. Refs #112.

Validation: all 268 tests passed (one skipped), repository Ruff checks/formatting, runtime Python lock, package build and CLI smoke passed. Final changed-file JetBrains assessment is RED with 13 existing findings outside changed lines; whole-project assessment reported 293 repository diagnostics. Runtime-only dependency/SQL metadata and older test/style findings remain tracked by #111. The final assessment used the exact worktree interpreter and verified project cleanup; incidental IDE changes were preserved separately and removed from this PR.

Anthropic claude-opus-5-5 independently reviewed both revisions against the pinned Odoo 19 source. Its first review found the pre-existing quoted-password failure; that failure was reproduced, fixed, and covered by the repeat-startup test. Final review reported no findings. No notification suppression or authentication policy change was added.

Owner test notes

Nothing for the site Owner to test in this shared-runtime PR. The CM consumer pin and testing rollout will be separate from the already accepted website change.

[shiny-code-app]

Final head 764af095328ec75594896ce7ce8a8a3845195b37 has all five PR checks passing, a clear comment radar, 268 passing local tests (one skipped), and the completed independent review recorded in the description.

The active Launchplane policy currently enrolls launchplane, codex-skills and the CM website only; odoo-devkit is not a train target. Native dry-run returned merge_train_controller_invalid_state (trace launchplane_req_aaf9ea4bc9d546b3a13605539dad9990), and an independent policy-target read confirmed the missing target. Use this repository's normal protected-branch merge, not a new grant or a forced merge. Broader repository enrollment remains cbusillo/launchplane#2455.