feat(pat): configure credential issuance separately from secret syncing

[c1-squire-dev]

Fifth in the stack, after #150. Splits credential issuance out of sync-secrets into its own issue-credentials flag, and documents it.

Why

sync-secrets gated four separate things: the secret and rsa_public_key syncers, the programmatic_access_token syncer, the token child-resource annotation, and the credential issuer itself. So a tenant who wanted a secret inventory had to grant the connector the ability to mint tokens to get it, and a tenant who wanted issuance had to take a full secret inventory they may not want. Neither is a choice they should be forced into.

What the flags mean now

sync-secrets	issue-credentials	secret types synced	issuer
off	off	none	no
on	off	secret, rsa_public_key, programmatic_access_token	no
off	on	programmatic_access_token	yes
on	on	all three	yes

Independent, with one deliberate overlap: the programmatic_access_token type is synced when either flag is set. Issuance advertises CREDENTIAL_RESOURCE_MODE_DISCOVERABLE, so turning it on has to make issued tokens syncable even when the broader secret sync is off — otherwise the credential exists with nothing holding a handle to revoke it, which is the defect this stack opened by fixing. secretOptions.tokensSynced holds that rule in one place instead of repeating the disjunction at each site.

TestSecretFlagsGateIndependently pins all four rows, asserting both the advertised resource-type set and the user resource's child annotations, so the annotations cannot drift away from the types they gate.

Compatibility

Nothing regresses. Credential issuance is not on main — d1a71db2 is not an ancestor of it and main's baton_capabilities.json carries no CAPABILITY_CREDENTIAL_ISSUE — so no tenant has issuance today, and sync-secrets keeps doing exactly what it does now. issue-credentials therefore defaults to off, which is the right default for a capability that mints credentials.

baton_capabilities.json is unchanged: cmd/baton-snowflake/main.go passes both flags to the default-capabilities builder, so the advertised set is the same as before.

Docs

The issuance section now names the flag and states that the two are independent. The setup step previously said only "Optional. Enable Sync secrets to display them on the Inventory page" — framed purely as display, with nothing telling a reader that issuance needed it. There is now a step for each flag.

Verification

go test ./pkg/... and golangci-lint run ./pkg/... ./cmd/... are clean. Both directions were also checked against a live Snowflake account, in process through the real ConnectorServer:

issue-credentials alone, sync-secrets off — full lifecycle, and a real sync discovers the token, which is the case the annotation rule exists for:

IssueCredential  -> DISCOVERABLE, expires 2026-09-10
real sync        -> programmatic_access_token count = 1 (4 walks over 3 users)
DeleteResourceV2 -> no error
real sync        -> count = 0

sync-secrets alone, issue-credentials off — the issuer is genuinely gone rather than merely unadvertised:

IssueCredential -> rpc error: code = Unimplemented
                   desc = resource type does not have credential issuer configured

One thing worth knowing, not fixed here

make generate does not regenerate pkg/config/conf.gen.go. There is no //go:generate directive anywhere in pkg/config, so its go generate ./pkg/config is a no-op, and running the generator directly (go run ./pkg/config/gen) writes conf.gen.go to the repo root rather than into pkg/config. The regenerated file is committed separately here; the Makefile is left alone since it is unrelated to this change.

[linear-code]

IGA-3962