fix(mosaic): bind lifecycle across storage and runtime

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -529,7 +529,29 @@ get_gitea_token() {
         esac
         if [[ -n "$_idpfx" ]]; then
             local _idtok="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.token"
+            local _idcred="$HOME/.config/mosaic/secrets/gitea-tokens/${_idpfx}-${_ident}.credential.json"
+            if [[ -r "$_idcred" ]]; then
+                local _resolved_token
+                _resolved_token=$(python3 - "$_idcred" <<'PY'
+import json, sys
+value = json.load(open(sys.argv[1], encoding="utf-8")).get("token")
+if not isinstance(value, str) or not value or any(ch.isspace() for ch in value):
+    raise SystemExit(1)
+print(value)
+PY
+) || return 1
+                if [[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]]; then
+                    printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=credential-resolved identity=%s host=%s shared_path_entered=false source=%s\n' \
+                        "$_ident" "$host" "$_ident_src" >&2
+                fi
+                printf '%s\n' "$_resolved_token"
+                return 0
+            fi
             if [[ -r "$_idtok" ]]; then
+                if [[ "${MOSAIC_CREDENTIAL_TRACE:-}" == 1 ]]; then
+                    printf 'MOSAIC_CREDENTIAL_RESOLUTION outcome=ok reason=credential-resolved identity=%s host=%s shared_path_entered=false source=%s\n' \
+                        "$_ident" "$host" "$_ident_src" >&2
+                fi
                 cat "$_idtok"
                 return 0
             fi