feat(providers): store refresh credentials in credential drivers

[mrunalp]

Summary

Store provider refresh secrets through the gateway's active credential driver instead of embedding them in refresh-state records. This keeps OAuth refresh tokens, client secrets, service-account private keys, temporary AWS source credentials, and minted access tokens behind driver-owned handles while preserving the existing refresh CLI workflow.

Related Issue

Closes #2797

Changes

• classify refresh material using caller markings, authoritative provider profiles, and strategy-defined secret fields
• stage secret writes through the active credential driver and commit only opaque handles to refresh state
• resolve gateway-only refresh inputs just in time for scheduled or forced mint operations
• atomically persist issuer-rotated refresh tokens and retry cleanup of superseded handles
• migrate legacy inline refresh secrets on worker startup while retaining legacy-driver resolution during transitions
• preserve last-known-good state across concurrent reconfiguration, deletion, failed rotation, and gateway restart scenarios
• hydrate authoritative resource versions on refresh-state list paths before compare-and-swap updates
• extend protobuf storage state and regenerate the Go bindings
• document storage ownership, migration safety, historical database retention, and operator workflows
• update the OpenShell CLI skill with external-driver refresh behavior and recovery guidance

Testing

• mise run pre-commit passes
• mise run ci passes
• Unit tests added and updated for storage, migration, rotation, concurrency, and cleanup
• Vault driver tests pass: 16 passed
• Server suite passes: 1,374 passed, 8 ignored
• Manual Vault + Podman E2E completed with gog and OpenClaw

The manual E2E used a loopback-only Vault 1.20.4 dev container and an isolated Podman gateway. Existing refresh inputs migrated into Vault, forced rotation succeeded without accumulating stale access-token objects, the Gmail probe succeeded before and after rotation, and OpenClaw returned EMAIL_ACCESS_OK without receiving the refresh token.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/2801 does not exist yet. A maintainer needs to comment /ok to test 0541d456d41b3937f92b8dba37c51441478529db to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[mrunalp]

/ok to test 0541d45