Extend configured credential brokerage to embedded aliases (#44066)

## What changed

- Discover configured provider credentials in child environment values even when canonical credential variables are absent. Match complete tokens while preserving regex word boundaries and avoiding ambiguous or overlapping provider matches.
- Replace and restore credentials by their original spans, preserving adjacent tokens and generated dummy aliases across destination rebinding. Reject dummy values that embed another provider's credentials.
- Extend text virtualization and provider source checks to configured credentials, including short credentials with distinctive prefixes, while preserving operational paths.
- Expose trusted provider metadata and active bindings through `CredentialBrokerEnvironment`, and remove marked configured credential variables when stripping the managed proxy environment.

## Testing

Add regression tests for alias discovery, regex boundaries and alternatives, overlapping and adjacent credentials, destination rebinding, dummy restoration, disallowed credential sources, and operational path preservation.

GitOrigin-RevId: dd85c595ce9550fbfdb07ef296a23e458ca165dd

codex-rs/network-proxy/src/proxy.rs

@@ -656,7 +656,7 @@ pub fn is_managed_proxy_env_var(key: &str, value: &str) -> bool {
 
 pub fn strip_managed_proxy_env(env: &mut HashMap<String, String>) {
     let brokered_credential_dummy_env_keys =
-        crate::credential_broker::brokered_credential_dummy_env_keys(env);
+        crate::credential_broker::marked_credential_dummy_env_keys(env);
     env.retain(|key, value| {
         !brokered_credential_dummy_env_keys.contains(key) && !is_managed_proxy_env_var(key, value)
     });
@@ -1194,6 +1194,26 @@ impl NetworkProxy {
         self.state.virtualize_brokered_text(text, env)
     }
 
+    /// Returns trusted provider metadata and active bindings for a child environment.
+    pub fn credential_broker_environment(
+        &self,
+        env: &HashMap<String, String>,
+    ) -> crate::CredentialBrokerEnvironment {
+        self.state.credential_broker_environment(env)
+    }
+
+    /// Checks whether recognized credentials originate from permitted provider variables.
+    pub fn credential_broker_sources_allowed(
+        &self,
+        value: &str,
+        virtualized: &str,
+        source_env: &HashMap<String, String>,
+        is_allowed: impl Fn(&str) -> bool,
+    ) -> bool {
+        self.state
+            .credential_broker_sources_allowed(value, virtualized, source_env, is_allowed)
+    }
+
     /// Restores known dummy credentials in trusted text captured for fail-open execution.
     pub fn restore_brokered_text(&self, text: &mut String) -> bool {
         self.state.restore_brokered_text(text)