[BuriKizilkaya]

Summary

• Allow team members to create local credentials with a shared ID, without a separate mapping.
• Clarify agent credential errors and protect credentials from being overwritten during runs.
• Add coverage for vault isolation, credential errors, and duplicate IDs.

Validation

• cargo fmt --all --check
• cargo test -p baton-adapters credentials::tests
• cargo test -p baton-adapters runtime::configured::tests
• cargo test -p baton-server --test credential_ids
• bun run check

Follow-up

• Device authentication token writes during a run: #126

Closes #125