fix(mosaic): harden credential lifecycle boundaries

packages/mosaic/framework/tools/git/git-credential-mosaic

@@ -38,25 +38,25 @@ trace_resolution() {
 # survives across non-persistent shells)  >  git-supplied username (credential.username
 # / URL). When the resolved identity has a matching per-agent token, use it instead of
 # the shared account. Backward-compatible: nothing resolvable → shared token.
+case "$host" in
+  git.uscllc.com) idpfx=gitea-usc;;
+  git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
+  *) idpfx="";;
+esac
 ident="$MOSAIC_GIT_IDENTITY"
 [ -z "$ident" ] && ident=$(git config --get mosaic.gitIdentity 2>/dev/null)
 [ -z "$ident" ] && ident="$username_in"
-if [ -n "${MOSAIC_AGENT_NAME:-}" ] && [ -n "$ident" ] && [ "$ident" != "$MOSAIC_AGENT_NAME" ]; then
+if [ -n "$idpfx" ] && [ -n "${MOSAIC_AGENT_NAME:-}" ] && [ -n "$ident" ] && [ "$ident" != "$MOSAIC_AGENT_NAME" ]; then
   echo "quit=true"
   printf 'MOSAIC_CREDENTIAL_REFUSAL outcome=refused reason=provider-identity-mismatch identity=%s fleet_identity=%s host=%s shared_path_entered=false source=git-credential-mosaic\n' \
     "$ident" "$MOSAIC_AGENT_NAME" "$host" >&2
   exit 1
 fi
 if [ -n "$ident" ]; then
-  case "$host" in
-    git.uscllc.com)      idpfx=gitea-usc;;
-    git.mosaicstack.dev) idpfx=gitea-mosaicstack;;
-    *) idpfx="";;
-  esac
   if [ -n "$idpfx" ]; then
     idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.token"
     idcred="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.credential.json"
-    if [ -r "$idcred" ]; then
+    if [ -e "$idcred" ] || [ -L "$idcred" ]; then
       token=$(python3 "$script_dir/resolve-credential-envelope.py" \
         "$idcred" "$ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || exit 1
       trace_resolution identity credential-resolved "$ident" "$host" git-credential-mosaic