refactor(credentials): resolve Vanta tokens through the coordinated client-token resolver - #9919

Summary

• vanta-token.ts is now a thin wrapper over resolveCoordinatedClientToken. The duplicated lock-and-memo machinery is gone: digests, lock_timeout, advisory lock, failure memo, decode helpers, upsert and invalidation by digest. About 180 lines are removed, so later fixes to the coordinated token chain reach Vanta too.
• CoordinatedClientTokenInput gains four optional fields: minRemainingMs, failureKeyQualifier, accessTokenDigestTag (also accepted by invalidateCoordinatedClientToken) and pinnedState. When a field is omitted the behavior is unchanged, so Shopify, Atlassian and Linear are unaffected.
• What Vanta reads and writes is byte-compatible with the previous code, so old and new workers share rows and contend on the same lock during a rolling deploy. That covers the row id, the advisory lock name and key, the failure-memo id and body, the access-token digest, the encrypted payload shape and order, the 30s reuse margin, and the first-mint scope pin.
• Vanta's exported API is unchanged.

Type of Change

• Refactor (no functional change)

Testing

• Compatibility proofs run against real Postgres in vanta-token.integration.ts (19 pass) and coordinated-client-token.integration.ts (11 pass). Fixture rows are seeded exactly as the previous build wrote them, using inline sha256 ids and digests and real encryption. The tests show that:
  • the new resolver serves a fresh stored token without calling the provider;
  • it honors an old failure memo and the expired-row scope pin;
  • a minted token and a refusal are written where the old build reads them, with byte-equal payloads;
  • invalidation matches the old digest;
  • the resolver blocks on a raw advisory lock taken with the old key, then serves the token the "old build" commits;
  • Shopify-style defaults keep their row id, digest and memo id.
• Five scratch format changes, made one at a time, each turned the suite red: the Vanta digest tag, the lock key, the failure-key scope, the default digest tag and the invalidation tag.
• bunx biome check, check:test-patterns, check:comment-hygiene and check:unused-exports pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)