Errors collected by the boot-time gauntlet. The resolver builder
accumulates these in a Vec so every misconfiguration surfaces in
one pass rather than one-per-run.
Render a credential path for user-facing messages. Paths carrying
the synthetic inline: prefix (legacy agents.<id>.google_auth
migrated into the store) are replaced with <inline credential>
so error output never echoes raw client_id / client_secret values.