[AUTOMATION] fix: optimize internal/run connectable credential retry scan

[michiosw]

Summary
This optimizes internal/run credential resolution by collecting disconnected entries during the first pass.

Before this, resolveCredentials walked every entry once, then scanned the failure map again to rebuild the disconnected subset for hosted connect retries.

Now the first pass is the canonical path:

if resolutionErr, ok := err.(*credentialResolutionError); ok && resolutionErr.Reason == failureDisconnected {
    connectableByEnvVar[entry.EnvVar] = entry
}

Why
This gives kontext-cli a cheaper maintenance/runtime path for managed credential startup:

managed env template entries
-> resolveCredentials first-pass tracking
-> hosted connect retry list

This PR does not broaden behavior beyond the optimization scope.

What changed
Optimized connectable credential collection in internal/run
Removed the extra disconnected-failure rescan before hosted connect retries
Preserved retry ordering, provider grouping, and launch warning behavior
Updated tests for connectable entry ordering

Verification
go test ./internal/run -run 'TestResolveCredentialsUsesInjectedProvider|TestSortedConnectableEntriesOrdersByEnvVar|TestResolveCredentialsReturnsIdentityMismatchError'
go test ./internal/guard/judge -run 'TestStartLlamaServerHealthCheckAndStop|TestStartLlamaServerEarlyExitDoesNotWaitForStopTimeout' -count=1 -v
go test ./internal/guard/judge -count=1
go test ./...
go vet ./...
git diff --check

[michiosw]

• [AUTOMATION] fix: optimize internal/run connectable credential retry scan #262 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR streamlines hosted credential retry collection during run startup. The main changes are:

• Tracks disconnected credential entries during the first resolution pass.
• Replaces the old disconnected-failure rescan with sorted connectable entries.
• Adds a unit test for deterministic connectable entry ordering.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
internal/run/run.go	Moves connectable credential tracking into the main resolution loop while preserving the sorted retry list behavior.
internal/run/run_test.go	Adds coverage for deterministic EnvVar ordering in the new helper.

_{Reviews (1): Last reviewed commit: "fix(run): avoid rescanning disconnected ..." | Re-trigger Greptile}