fix(credentials): point the AWS keyless hint at the policy audience, quote the docs client ID, and correct a stale comment - #9970

Summary

Three small fixes from the final review of the configurable keyless audience (#9962):

• AWS dialog hint: the Audience field is now an editable input, so the hint no longer says to copy "the audience above". It points to the trust policy's aud value, which always shows the audience in use, default or custom.
• AWS docs: the add-client-id-to-open-id-connect-provider example quotes --client-id '<your audience>'. Allowed audiences can contain # and &, which the shell would misread unquoted.
• Databricks TSDoc: a comment said every tenant shares the audience. Now that a credential can set its own, it says tenants share the issuer and can claim any audience. The subject-pin probe it explains is unchanged.

Type of Change

• Bug fix

Testing

• bun run lint passes.
• check:comment-hygiene, check:docs and check:client-boundary pass.
• The docs content:verify-compatibility check passes.
• The AWS and Databricks server tests pass (43).
• There is no behavior change.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)