fix(mosaic): close credential evidence gaps

packages/mosaic/framework/tools/git/git-credential-mosaic

@@ -24,6 +24,15 @@ while IFS= read -r line; do
     username=*) username_in=${line#username=};;
   esac
 done
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+trace_resolution() {
+  [ "${MOSAIC_CREDENTIAL_TRACE:-}" = 1 ] || return 0
+  resolution_path="$1" reason="$2" trace_identity="$3" trace_host="$4" source="$5"
+  shared_path_entered=false
+  [ "$resolution_path" = shared ] && shared_path_entered=true
+  printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=%s identity=%s host=%s resolution_path=%s shared_path_entered=%s source=%s\n' \
+    "$reason" "$trace_identity" "$trace_host" "$resolution_path" "$shared_path_entered" "$source" >&2
+}
 # Per-agent identity resolution (Gate-16 author≠reviewer separation).
 # Priority: MOSAIC_GIT_IDENTITY env  >  git config mosaic.gitIdentity (per-worktree,
 # survives across non-persistent shells)  >  git-supplied username (credential.username
@@ -48,27 +57,15 @@ if [ -n "$ident" ]; then
     idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.token"
     idcred="$HOME/.config/mosaic/secrets/gitea-tokens/${idpfx}-${ident}.credential.json"
     if [ -r "$idcred" ]; then
-      token=$(python3 - "$idcred" <<'PY'
-import json, sys
-value = json.load(open(sys.argv[1], encoding="utf-8")).get("token")
-if not isinstance(value, str) or not value or any(ch.isspace() for ch in value):
-    raise SystemExit(1)
-print(value)
-PY
-) || exit 1
-      if [ "${MOSAIC_CREDENTIAL_TRACE:-}" = 1 ]; then
-        printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=credential-resolved identity=%s host=%s shared_path_entered=false source=git-credential-mosaic\n' \
-          "$ident" "$host" >&2
-      fi
+      token=$(python3 "$script_dir/resolve-credential-envelope.py" \
+        "$idcred" "$ident" "${MOSAIC_CREDENTIAL_ESTATE:-}" "$host") || exit 1
+      trace_resolution identity credential-resolved "$ident" "$host" git-credential-mosaic
       echo "username=${ident}"
       echo "password=${token}"
       exit 0
     fi
     if [ -r "$idtok" ]; then
-      if [ "${MOSAIC_CREDENTIAL_TRACE:-}" = 1 ]; then
-        printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=credential-resolved identity=%s host=%s shared_path_entered=false source=git-credential-mosaic\n' \
-          "$ident" "$host" >&2
-      fi
+      trace_resolution identity credential-resolved "$ident" "$host" git-credential-mosaic
       echo "username=${ident}"
       echo "password=$(cat "$idtok")"
       exit 0
@@ -98,10 +95,10 @@ esac
 # Script-relative (not $HOME-absolute) so this resolves correctly regardless
 # of where the framework installer places tools/ under $HOME — mirrors
 # detect-platform.sh's own cred_loader resolution in this same directory.
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../_lib/credentials.sh
 source "$script_dir/../_lib/credentials.sh"
 load_credentials "$svc" >/dev/null 2>&1 || exit 0
+trace_resolution shared shared-credential-resolved '<interactive-shared>' "$host" credentials-loader
 # GITEA_USER is not populated by load_credentials (it only exports
 # GITEA_URL/GITEA_TOKEN for gitea-*), so this fallback is normally taken. Gitea's
 # git-over-HTTP auth authenticates from the token itself (the password field),