Handle credential provider source remapping across config layers (#44241)

## What changed

- Let higher-priority providers in `features.network_proxy.credentials` displace lower-priority providers with overlapping `env` sources, including in profiles. Preserve inherited settings when providers swap sources, and compare environment names case-insensitively on Windows.
- Preserve provider definitions across ordered batch remaps and persist displaced-provider removals without overwriting unrelated sibling updates.
- Validate remapped providers using the credential broker's compilation rules before persisting writes, while allowing incomplete drafts and explicit deletions.
- Omit displaced providers from config origins and report writes overridden by another provider's source ownership.
- Build trusted credential-broker configuration before merging managed layers for project discovery, preserving remapped providers' environment protections.

## Testing

Add unit and config RPC regression tests for source precedence, source swaps, ordered edits, concurrent sibling updates, atomic rejection of invalid remaps, persistence, and override reporting. Add a macOS managed-config regression test for remapped provider bindings during project discovery.

GitOrigin-RevId: b7d402727acf4e5b0f25946db1cf18811f5e2679

codex-rs/network-proxy/src/credential_broker/provider_config.rs

@@ -21,6 +21,14 @@ pub struct CredentialProviderConfig {
     pub prefix: Option<String>,
 }
 
+impl CredentialProviderConfig {
+    /// Validate a complete provider definition using the broker's compilation rules.
+    pub fn validate(&self, id: &str) -> anyhow::Result<()> {
+        super::configured::ConfiguredCredentialProvider::compile(id, self)?;
+        Ok(())
+    }
+}
+
 /// Authentication formats supported by declarative credential providers.
 #[derive(Clone, Copy, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
 #[serde(rename_all = "snake_case")]