fix(index): retry credential resolution during boot to avoid permanent

[dearbld]

Retry credential resolution during boot to avoid permanent lexical fallback

Base: on top of pr-5 (resolveKey plumbing) · stacked series: pr-1 → pr-2 → pr-4 → pr-5 → this PR

Motivation

apply() starts the background boot immediately: load persisted state → build('full') → embed → resolveKey. At that moment the host's credentials service may still be loading its store. If the key resolves to empty just once, the first embed fails, and with allowFallback the index pins itself to the local lexical provider permanently — observed in production: provider config entirely correct, sema(action=stats) still reporting the lexical provider after the credential had been available for minutes.

The service contract explicitly supports this pattern: resolution is per call, and consumers re-resolve at each operation.

What changes

• inject gains credentials.
• When the provider is openai and provider.apiKeyEnv names a credential reference, apply builds a resolveKey that resolves through ctx.credentials.resolve(credentialRef(...)) per operation — with a boot-race retry: up to 30 attempts, 1s apart, until the credential resolves. Once the store is ready the first iteration resolves immediately; the cap bounds the wait when the reference is genuinely unconfigured.
• package.json: @deepseek-ai/dsh-credentials added to peerDependencies (>=0.1.0-rc.6 <0.2.0) and devDependencies; package-lock.json intentionally not included (regenerate in CI).
• Keys resolved this way never touch process.env, and rotation applies without a restart.

Before / after

// before: one empty resolution at boot = permanent lexical provider
const index = new SearchIndex(resolved, logger)

// after: retry until the credential service is ready (30s cap), then per-op resolution
const resolveKey = kind === 'openai' && credRef ? async () => { /* 30 × 1s retry loop */ } : undefined
const index = new SearchIndex(resolved, logger, resolveKey)

Testing

• tsc --noEmit clean; full suite 85/85 pass, including a new integration test: mock credential service empty for two calls, then ready — boot build waits through both retry intervals, the embed request carries the late key (Bearer sk-late), no boot errors logged.
• Suggested: against a real harness, start the plugin the moment the credentials file is being written and assert stats() reports the openai provider, not lexical.