Add tool settings files for configurable tool defaults

Tools can now ship with defaults.yaml containing configurable settings
that users can customize via settings.yaml (auto-created from defaults).

Features:
- ensure_settings() helper copies defaults to settings on first use
- Settings available as {settings.key} in templates (scalars only)
- Full dict access via settings['key'] in code steps
- CLI: cmdforge settings <tool> show/edit/reset/diff
- GUI: Defaults editor in Tool Builder, Configure button on Tools page
- Registry: defaults.yaml published with tools, included in downloads
- Secret detection warning on publish (api_key, password, token, etc.)

Fully backward compatible - tools without defaults work unchanged.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

src/cmdforge/cli/collections_commands.py

@@ -654,13 +654,16 @@ def _publish_single_tool(tool_name: str, client) -> dict:
     if not tool:
         return {"success": False, "error": f"Tool '{tool_name}' not found"}
 
-    # Load README if exists
-    readme_path = get_tools_dir() / tool_name / "README.md"
+    # Load README/defaults if exists
+    tool_dir = tool.path.parent if tool.path else (get_tools_dir() / tool_name)
+    readme_path = tool_dir / "README.md"
     readme = readme_path.read_text() if readme_path.exists() else ""
+    defaults_path = tool_dir / "defaults.yaml"
+    defaults = defaults_path.read_text() if defaults_path.exists() else ""
 
     try:
         config_yaml = yaml.safe_dump(tool.to_dict(), sort_keys=False)
-        result = client.publish_tool(config_yaml, readme=readme, dry_run=False)
+        result = client.publish_tool(config_yaml, readme=readme, defaults=defaults, dry_run=False)
 
         # Update local tool config with registry metadata
         config_path = get_tools_dir() / tool_name / "config.yaml"