perf(core): ignore credential events for unrelated integrations - #60782

Problem

Every Location runs two listeners that wake up on any credential event for any integration:

• credentialSettings (Bedrock, both Cloudflare plugins, GitLab) re-reads its integration's active credential on every credential.updated and credential.switched, even when the event is about some other integration. That's 4 listeners doing a list plus a get each, per Location, per event.
• Provider runs notify (snapshot plus integrations.list(), which reads every credential) on every credential.updated, even though that event can't change which providers are available.

Change

credential.updated is only published for a create, a label rename or a remove. Any of those that changes the active credential also publishes credential.switched. So updated alone never changes the active credential's value, and never takes an integration from zero connections to some or back.

 credentialSettings
-  subscribe([Credential.Updated, Credential.Switched])
+  subscribe(Credential.Switched)
+  filter(event.integrationID === integrationID)

 Provider
-  subscribe([Integration.Updated, Credential.Updated, Credential.Switched])
+  subscribe([Integration.Updated, Credential.Switched])

What that buys per Location:

I added a test that a Cloudflare Workers AI form login switch still updates the account ID, so the filter doesn't drop its own integration's events.

Out of scope

• Provider still reacts to every credential.switched, including integrations it has no provider for. Filtering that would mean checking the provider records on each event, and the switch is rare enough that I left it.
• google-vertex.ts and config/plugin/policy.ts have the same unfiltered subscription shape.