fix: stop the driver password requests breaking driver auth, and give the manifest requests a manifest

[roncodes]

Follow-up to #53. That PR is merged; this fixes what it broke in the FleetOps contract run
(failing run —
4 assertion failures and 3 run errors, all attributable to #53).

1. Create a Driver was overwriting the seeded driver's identity

driver_identity, driver_password and driver_phone name the driver a contract run seeds and
injects with --env-var. Login Driver, Request Driver Login SMS and Verify Driver Login
Code authenticate as that driver. #53 had Create a Driver write its own throwaway driver into those
three variables, so all three signed in as an account that gets deleted later in the run:

Login Driver              401
Request Driver Login SMS  400
Verify Driver Login Code  400

It now writes created_driver_email / created_driver_phone / created_driver_password and leaves
the injected names alone. Change Driver Password proves the created driver's own password.

2. pm.execution.skipRequest() is not a skip

#53 guarded the requests that need a fixture with it. The Postman CLI reports that as
"Request could not be completed" — a run error, which fails the contract exactly as a bad
response would. That was the three Error entries. Every guard is gone; each request now has
something real to address.

3. The manifest requests had no manifest

POST /orchestrator/commit is what creates a manifest — it returns the ids it created. The Manifests
folder is now ordered after Orchestrator and takes its id from there, and Retrieve a Manifest passes a
stop id to Update a Manifest Stop. The note in #53 claiming the API cannot create a manifest was
wrong.

4. Reset Driver Password needed a code meant for a reset

resetPassword matches a verification code on subject, value and purpose, and its purpose is
driver_password_reset. A driver_login code does not satisfy it. It now asks for
{{driver_password_reset_code}}, seeded by fleetbase/fleetbase#636, and sets the password back to
the one already in force so the run stays repeatable and the login requests still authenticate.

Merge order

fleetbase/fleetbase#636 first, then this. Without it Reset Driver Password has no code to send.

Verified

Run against a live instance under the contract run's own request ordering
(scripts/ci/order-collection-requests.py, which defers every DELETE to the tail — the reason a
plain local run is not a faithful simulation):

Request	Result
Change Driver Password	Pass
Request Driver Password Reset	Pass
List Driver Manifests	Pass
Retrieve a Manifest	Pass
Optimize a Manifest	Pass
Update a Manifest Stop	Pass
Reset Driver Password	400 — awaiting #636; the local instance has no seeded code

The manifest chain resolves real ids end to end (commit → manifest_7sedsluegw → stop
mstop_wsdnxmfafv → 200), where before the URLs still contained a literal :id.

Lint is clean: 196 requests, 0 errors, 0 warnings.