[zzwong]

Summary

Stacked on #718. Resolve identity-provider API keys through explicit credential-store references and fixed provider key names. Offline suites use credential: {store, name} for direct and saved-candidate selection; setup stays in cr set-credential. The unshipped environment-key field and flag are removed together with no fallback.

Preflight the largest complete retained fixture before reading a key or sending requests. If serialization would exceed replay’s limit, retain the valid original input and report the size failure with zero provider calls. Compact fixture encoding also avoids unnecessary HTML expansion. Regression tests inspect each actual cohort request and preserve unknown costs for nonzero cache writes.

This addresses the credential, retention and test findings on #714 and #715, and supplies the contracts needed by the dependent review diagnostic.

Validation

• Full make check passed: tidy, formatting, lint, the complete test suite and build.
• Focused credential, ingress, command, replay, provider and architecture tests passed. Cases cover fixed-key/ref isolation, store cleanup, cancellation before client construction, replayable error artifacts, pair routing and cache-cost uncertainty.
• Independent source review found no remaining production issues; its cancellation coverage follow-up is included and passes. Verification used fake stores and providers, with no live credential reads or inference calls.
• Review follow-ups add hermetic command tests with the production resolver and isolated file-backed synthetic credentials, exercising direct and saved-candidate key selection plus zero-call failure cases. The retained-size tests now build an independent maximum-size oracle; a Go overlay changing the production maximum choice to its shorter alternative fails the one-byte-over-limit regression. Focused command, credential and experiment tests pass, lint reports zero issues, and no production behavior changed in this follow-up.

[zzwong]

Add command coverage for the production credential resolver, an independent retained-size boundary assertion, and the complete documented key allowlist. Details inline.