Greptile Summary

Fixed false missing or expired auth warnings for SecretRef profiles by attempting deferred credential resolution when profiles are excluded by legacy auth order filtering. When a profile has keyRef or tokenRef configured, the code now attempts to resolve credentials via resolveApiKeyForProfile before emitting the warning. If resolution succeeds, the profile is included in probe targets; if it fails, the original warning behavior is preserved.

• Refactored buildProbeTargets to async/await and exported it for testing
• Added canResolveDeferredProfileCredential helper to identify profiles eligible for deferred resolution
• Comprehensive test coverage for both success and failure paths of SecretRef resolution
• Empty catch block at src/commands/models/list.probe.ts:249 intentionally preserves legacy error messaging when resolution fails

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• Score reflects well-structured logic, comprehensive test coverage, and correct async/await refactoring. The deferred resolution logic properly handles both success and failure paths, maintains backward compatibility, and follows the project's TypeScript conventions. No security vulnerabilities or logical errors identified.
• No files require special attention

_{Last reviewed commit: 31d3a95}

Thanks for the report! Superseded by #33733.