fix(executor): resolve saved model credentials inside each fallback attempt in Router and Evaluator - #9968

Summary

• Router (v1 and v2) and Evaluator now resolve saved credentials inside each model attempt. Before, they resolved the saved Vertex or Bedrock credential before their fallback loop, so a credential that couldn't be resolved failed the block before any configured fallback model ran. This covers revoked or unauthorized credentials and a transient AWS STS failure. The Agent block already resolves credentials per attempt.
• New shared helper, resolveBlockModelCredentials in executor/utils/model-credentials.ts, used by Agent, Router and Evaluator. It replaces three inline copies of the Vertex lookup and the Bedrock-only helper.
• Fallback behavior in executeModelRequestWithFallbacks:
  • The credential is resolved once per call, only for candidates on the primary's provider, and merged after the fallback API-key choice. A same-provider fallback row never carries its own key, so its key and token are unchanged.
  • A failed resolution fails the remaining same-provider candidates without calling again, then the loop moves to other providers.
  • Other-provider candidates still get no session and no family credentials.
• Agent's cross-provider omit now uses the shared BLOCK_MODEL_CREDENTIAL_FIELDS list.
• Docs fix: the v2 knowledge connector credentialId description no longer says it is null for every API-key source. A saved-credential apiKey source sets it.

Type of Change

• Bug fix

Testing

• New tests:
  • Router and Evaluator answer from a cross-provider fallback when the saved AWS credential is unavailable on the final try, and record the primary as failed.
  • A same-provider fallback reuses the resolved session without resolving again.
  • A failed resolution is not retried on the next same-provider candidate, and no session reaches the other provider.
• Red proofs:
  • The handler tests fail on the old handlers.
  • The reuse test fails without the cache.
  • The failed-resolution test fails when only successful results are cached.
• Existing tests: the existing Bedrock signing, blank-credential, fail-closed and fallback-omit tests are unchanged and pass.
• Runs: 1,693 executor and LLM tests pass. So do bun run lint and check-block-registry.ts origin/staging.
• Audits: check:openapi, check:cli-api, check:cli-docs, check:mcp-operations, check:api-validation:strict, check:test-patterns, check:comment-hygiene, check:explicit-any, check:client-boundary, check:boundaries, check:utils, check:file-names, check:docs and check:tool-registry-boundary pass.
• Type-check and the full suite run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)