The composition root's credential build: turn each active mount's resolved mirror-write credential into a live, process-global CredentialProvider.

Global providers, per-mount reference

A CredentialProvider is the service's own cloud identity, built once here from the resolved config and held process-global; a mount references one by its ecosystem and never holds its own. Which credential each mount uses is no longer selected here: it is __derived from the mirror-target URL at config load__ (resolveMirrorCredential) and carried on the mount as a MirrorCredential, so a CodeArtifact token can only ever be minted for the domain the worker actually writes to (issue #808). This module just realises that resolved plan:

• MirrorStatic -- a stateless static provider from the operator-supplied token.
• MirrorCodeArtifact -- the refresh/cache wrapper around the CodeArtifact mint leaf (newCodeArtifactProvider), which mints once eagerly, so a misconfigured identity or a missing permission fails loudly here at boot as a CodeArtifactMintFailed. AWS credentials are the ambient container/task role (the standard chain), never an Écluse key.

Provider granularity follows the credential's real scope, not the mount count: a CodeArtifact token is minted per domain, so mounts whose resolved CodeArtifact identities coincide (codeArtifactIdentityGroups) share one provider -- one eager boot mint, one refresh schedule, one breaker -- while each still looks its provider up by its own ecosystem.

The CredentialReporters are handed to the refreshing CodeArtifact provider so its mint breaker and refresh outcomes record to telemetry; the static provider never refreshes, so they do not concern it. The composition root supplies the deferred reporters that go live once the telemetry substrate exists. Failures aggregate as BootErrors, so one run reports every domain that failed to mint.