## Why
Project configuration must not influence credential-provider environment variables or shell startup behavior while credentials are being brokered.
## What changed
- Track credential brokering as unconfigured, disabled, or enabled, and apply effective network proxy requirements before sanitizing project layers.
- When brokering is enabled, ignore project settings for shell snapshots, profile loading, `ZDOTDIR`, `BASH_ENV`, and credential-provider environment variables.
- Preserve those project shell settings when requirements disable credential brokering.
## Testing
Added coverage for active and disabled broker states, protected credential environment variables, and shell startup settings.
GitOrigin-RevId: 6967cbffdfbb60424a2d2324bad5b91bd2ccfcf6
fd1bf50410