fix(credentials): replay remembered refusals as credential errors, derive the delegable Google services list, and correct a fallback TSDoc - #9993

Summary

Follow-ups from the final review of the v0.9.56 credential changes:

• Remembered refusals are no longer reported as outages. The shared client-credentials failure memo can only store a few codes, so a refusal such as host_not_allowed or consent_required is stored as provider_unavailable. improvement(credentials): resolve agent fallback credentials once, Vanta 401 grace, true refusal codes, headless client-credential modes, and registry cleanups #9977 gave the first caller the real code, but every replay within the window still returned provider_unavailable, which maps to a 502 "temporarily unavailable". That told users to wait instead of fixing the credential.
  • replayedFailure now relabels a remembered refusal (isRememberedRefusal) to invalid_credentials with its stored status, which maps to "reconnect the credential". No new stored codes, so older builds still decode every memo.
  • Throttled and 5xx memos still replay as provider_unavailable.
  • The per-instance mint cache also now treats the replay as permanent rather than transient.
• Delegable Google services come from one list. GOOGLE_DELEGATION_SERVICE_NAMES moves next to GOOGLE_DELEGATION_SERVICES and is used by the keyless refusal messages and the connect dialog, so the wording can't drift from the list. The text is unchanged.
• TSDoc fix. The credentials TSDoc in model-fallback-request.ts now says it is resolved once per call and shared by same-provider fallbacks.

Type of Change

• Bug fix

Testing

• Integration (coordinated-client-token.integration.ts): run against a throwaway local Postgres, 56 tests with vanta-token.integration.ts.
  • A replayed consent_required refusal comes back as invalid_credentials / 400, and the exchange runs once. This fails on the previous code.
  • The previous build's lossy refusal row now replays as a credential error.
  • Throttled replays still return provider_unavailable. This fails if the relabel is broadened to every 4xx.
• Unit: 2,357 tests across lib/credentials, lib/oauth, executor/utils and the connect dialog pass.
• Lint and audits: bun run lint, check:client-boundary, check:boundaries, check:comment-hygiene, check:test-patterns, check:explicit-any, check:test-types and check:tool-registry-boundary --check pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)