Guard delete of in-use credential/parameter set

[kichristensen]

What does this change

porter credentials delete / porter parameters delete removed the set
unconditionally, even if an installation's credentialSets/
parameterSets still named it. The next apply/upgrade then failed to
resolve the missing set, with no link back to the delete that caused it.

Both commands now check whether any installation still references the
set before deleting, and require --force to proceed if so:

$ porter credentials delete github
Error: credential set github is in use by the following installation(s): dev/wordpress; if you are sure it should be deleted, retry the last command with the --force flag

$ porter credentials delete github --force

Credential/parameter sets resolve with a namespace fallback (local
namespace, then global). Deleting a global set excludes installations
whose own namespace shadows it with a same-named local set, so that
case isn't a false positive.

What issue does it fix

Closes #3640

Notes for the reviewer

Raised by @carolynvs in #1781, split out of #3637 as out-of-scope there.

Only pkg/porter tests were added (backed by a real datastore, same as
the existing TestCredentialsDelete); no tests/integration test, since
the feature is pure storage/query logic with no bundle-execution surface
and there's no existing integration-level precedent for the credentials/
parameters CLI commands.

Checklist

• Did you write tests?
• Did you write documentation?
• Did you change porter.yaml or a storage document record? Update the corresponding schema file.
• If this is your first pull request, please add your name to the bottom of our Contributors list. Thank you for making Porter better! 🙇‍♀️

[Copilot]

Pull request overview

This PR adds safety checks to prevent porter credentials delete / porter parameters delete from silently deleting sets that are still referenced by one or more installations, requiring an explicit --force override when the set is in use (including correct handling for global sets shadowed by same-named local sets).

Changes:

• Add --force option and pre-delete “in use by installations” guard for credential/parameter set deletion.
• Implement namespace-aware usage detection (including global-vs-local shadowing semantics).
• Add unit tests and update CLI reference docs to document the new flag/behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/porter/parameters.go	Adds Force option and usage detection logic before deleting parameter sets (with global shadowing behavior).
pkg/porter/parameters_test.go	Adds tests for delete behavior: not in use, blocked without force, forced delete, and shadowed global set.
pkg/porter/credentials.go	Adds Force option and usage detection logic before deleting credential sets (with global shadowing behavior).
pkg/porter/credentials_test.go	Adds tests for delete behavior when credential sets are referenced and for shadowed global sets.
cmd/porter/parameters.go	Wires --force flag into porter parameters delete.
cmd/porter/credentials.go	Wires --force flag into porter credentials delete.
docs/content/docs/references/cli/parameters_delete.md	Documents the new --force flag for parameters delete.
docs/content/docs/references/cli/credentials_delete.md	Documents the new --force flag for credentials delete.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.