Keep credential discovery off Editor and Session mailboxes

[breznknecht]

TL;DR

Credential status now classifies one local snapshot immediately and runs live Ollama discovery outside Editor and Session mailboxes. Correlated, bounded checks keep interactive processes responsive and prevent delayed results from affecting a replacement session, model, or provider.

Closes #3317

Context

Credential status previously mixed local configuration checks with a synchronous Ollama HTTP probe. A slow local endpoint could therefore delay /auth, session startup, credential refresh, prompt handling, and model controls.

This change separates locally known configuration from live availability. Session owns provider readiness and startup decisions, while Editor owns publication of /auth results into the session that requested them.

Changes

• Acquire credential sources once per snapshot, preserve source precedence, and classify local readiness without network work or secret-bearing status values.
• Run Ollama discovery through a bounded availability worker with request tokens, logical session and model correlation, timeout/crash/startup-failure cleanup, and newest-request coalescing.
• Invalidate and stop obsolete work across credential refresh, model changes, new_session, load_session, and owner shutdown.
• Move /auth availability publication into a correlated Editor effect that validates both the Session PID and logical session ID before updating UI state.
• Return explicit pending, unavailable, stale, and rejected outcomes so prompts and provider controls do not claim work that was not accepted.
• Apply a pending model change to an already-running provider exactly once after the current discovery succeeds, never after a stale or unavailable result.
• Add deterministic held-probe, message-barrier, cleanup, correlation, and provider-observable tests without sleeps or a real Ollama dependency.

Verification

• mix test test/minga_agent/session_recovery_test.exs test/minga_editor/agent/slash_command_test.exs test/minga_editor/commands/agent_commands_test.exs: 140 passed on the final rebased SHA.
• Relevant credential, Session, Editor effect, command, and event-routing test set: 226 passed.
• mix compile --warnings-as-errors: passed on the final rebased SHA.
• make lint: passed.
• Full mix test: 10,958 of 10,959 passed. The only failure was the unrelated Minga.Extension.CompileCacheTest stderr capture race at test/minga/extension/compile_cache_test.exs:709; its exact rerun passed.
• Narrow regression review of the three corrected correlation and provider-control flows: passed with no findings.
• Final acceptance review against the locked Developer Notes: passed with no findings.

Acceptance Criteria Addressed

1. Held Ollama probes no longer block unrelated Editor or Session messages. ✅
2. Credential precedence and existing OAuth, custom-provider, and injected-client readiness behavior remain intact without exposing credential values. ✅
3. Automatic Ollama discovery remains available, with distinct pending and unavailable states. ✅
4. Credential, model, refresh, and session changes invalidate obsolete probe results. ✅
5. Active and coalesced work is bounded, and every terminal path cleans up workers, timers, and monitors. ✅
6. Prompt and provider-control callers receive truthful outcomes without duplicate delivery or startup. ✅