bug(supervisor): revoking provider credentials does not close connections that used them #5365

Summary

When the supervisor revokes static provider credentials, open connections are not re-checked. A connection that already authenticated upstream with a revoked credential (for example an upgraded WebSocket, or a streaming response) stays open.

Cause

Two functions in config_runtime.rs revoke static credentials without touching the OPA engine, so no policy generation is published and no relay wakes:

• revoke_provider_environment calls revoke_static_provider_environment (L808). It runs when a provider refresh fails, when the environment is not installable (for example UnsupportedSupervisor), and when the delivered snapshot is for a different revision (provider_environment_mismatch).
• reject_provider_bindings reinstalls the rejected environment to revoke static material (L839). It runs when bindings fail validation, for example a value with no classification.

New requests are handled correctly, because credentials are resolved per request and the revoked placeholder no longer resolves. Only sessions that were authenticated once and then kept open are affected.

Steps to reproduce

1. Attach a provider with a static credential and open a WebSocket through the proxy that injects it at upgrade.
2. Make the next provider refresh fail, for example by delivering a snapshot the supervisor rejects.
3. The supervisor logs that static credentials were revoked, but the WebSocket stays open.

Expected

Revoking a credential re-checks open connections, and those that sent the revoked credential close. Connections that never sent it stay open. A revocation that finds nothing left to revoke, for example the same failed refresh repeating on every poll, should not wake connections again.

Environment

OpenShell main at af8182f.

Drafted with Claude Code.