[AUTOMATION] fix: optimize internal/run connectable credential scan

[michiosw]

Summary
This optimizes internal/run credential startup by collecting connectable entries during the first resolution pass.

Before this, disconnected credential failures lived in internal/run/run.go, then the code rescanned the failure map to rebuild the same connectable entry list before hosted connect could start.

Now the first resolution pass is the canonical path:

if resolutionErr, ok := err.(*credentialResolutionError); ok && resolutionErr.Reason == failureDisconnected {
    connectable = append(connectable, entry)
}

Why
This gives kontext-cli a cheaper maintenance/runtime path for hosted credential startup:

managed kontext start
-> resolveCredentials
-> sorted connectable entries without a second failure-map scan

This PR does not broaden behavior beyond the optimization scope.

What changed
Optimized connectable credential collection in internal/run/run.go
Removed the extra failure-map rescan before hosted connect starts
Preserved connectable entry ordering and existing warning flow
Updated no behavior outside the hosted credential startup path

Verification
go test ./internal/run
go test ./...
go test ./internal/guard/judge -run 'TestStartLlamaServerHealthCheckAndStop|TestStartLlamaServerEarlyExitDoesNotWaitForStopTimeout' -count=1 -v
go test ./internal/guard/judge -count=1
go vet ./...
git diff --check

[michiosw]

• [AUTOMATION] fix: optimize internal/run connectable credential scan #244 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR changes how disconnected credentials are collected during credential resolution. The main changes are:

• Tracks connectable credential entries during the initial resolve loop.
• Removes the later scan over the failures map.
• Keeps the connectable credential list sorted before hosted connect handling.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• The updated collection path preserves the previous filtering and sorting behavior for normal template-derived entries.
• Existing failure reporting and retry cleanup behavior remain unchanged.

Important Files Changed

Filename	Overview
internal/run/run.go	Tracks disconnected credential entries inline instead of recomputing them from the failures map.

_{Reviews (1): Last reviewed commit: "fix(run): avoid rescanning disconnected ..." | Re-trigger Greptile}