Treat credential derivation as part of the runtime contract
When a connection strategy changes, every environment-specific credential generator and validator belongs to the same runtime contract. Update derivation, validation, regression tests, and deployment documentation together, or a preview or secondary environment may recreate the r…