Fix: honor the credentialKey override in the OpenAPI tool credential cache slot (stacked on #864)

[AmaadMartin]

Please ensure you have read the contribution guide before creating a pull request.

Stacked on #864 (fix/openapi-credential-key-identity). Review and merge that one first; this PR targets its branch.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

N/A

2. Or, if no issue exists, describe the change:

Problem: The credentialKey option reaches only the auth request slot (temp:<key>), never the exchanged-credential cache slot. ToolContextCredentialStore derives the cache key from the scheme and credential digests alone, so a developer who sets credentialKey cannot choose the cache slot, share one credential across tools, or keep two tools apart. The adk-python docstrings promise the option covers "interactive auth and credential caching", so the option does half of what it says.

Solution: The store now takes the override on its constructor and returns it verbatim ahead of the digest. The constructor is the single site both the read path and the write path derive their key from, so the two cannot disagree. An absent or empty key still derives the scheme+credential digest key from #864.

Notes for the reviewer:

• This is not a parity port. adk-python has the same gap: its _get_credential_key_override() is read only by _build_auth_config(), and ToolContextCredentialStore.get_credential_key() never sees it. adk-js fixes it first; adk-python follows separately.
• A toolset-wide key now makes its tools share one slot. OpenAPIToolset hands one credentialKey to every tool it builds, so credentialKey on a toolset means one exchanged-credential slot for all of them. That is the documented intent, and it is opt-in: the derived key still isolates per tool by default.
• A credential already cached under the derived key becomes unreachable for a developer who sets credentialKey. The cost is one extra exchange, after which it caches at the new slot. There is deliberately no fallback read of the old key: Fix: key the OpenAPI tool credential cache on scheme and credential identity #864 dropped exactly that ambiguous second lookup one commit earlier.
• Collision check. I listed the 100 open PRs on this fork and diffed every one touching tool_auth_handler.ts (Fix: request user consent for authorization-code OpenAPI tools #862, Fix: refresh an expired stored OAuth2 credential in ToolAuthHandler #772, Fix: accept an AuthScheme at the OpenAPI tool entry points #774) plus Test: build the tool_auth_handler suite from real Contexts #845 and Fix: assert the OpenAPIToolset global auth override through the public API (stacked on #337) #645. None reads the override in the store. Fix: key the OpenAPI tool credential cache on scheme and credential identity #864 is the base this stacks on.

Testing Plan

CI does not run on this PR. validation.yaml, license-check.yml and cross-language-integration.yml all trigger on pull_request: branches: [main], and this PR's base is fix/openapi-credential-key-identity. Only auto-assign ran. Everything below was run locally on the pushed commit 1b76b82.

Unit Tests:
[x] I have added or updated unit tests for my change.
[x] All unit tests pass locally.

Four cases added at the end of core/test/tools/openapi_tool/tool_auth_handler_test.ts. No existing test was edited.

npx vitest run --project unit:core \
  core/test/tools/openapi_tool/tool_auth_handler_test.ts \
  core/test/tools/openapi_tool/rest_api_tool_test.ts \
  core/test/tools/openapi_tool/openapi_toolset_test.ts \
  core/test/utils/hash_utils_test.ts
# Test Files 4 passed (4) / Tests 76 passed (76)

npx vitest run --project integration tests/integration/tools/openapi_credential_cache_test.ts
# Test Files 1 passed (1) / Tests 2 passed (2)

Coverage of tool_auth_handler.ts over the two suites that exercise it is 100% of statements, branches, functions and lines.

Mutation proof. I deleted the if (this.credentialKeyOverride) { return ...; } early return and re-ran the file. Three of the four new tests failed:

AssertionError: expected [ 'temp:my_tool_tokens', …(1) ] to deeply equal [ 'temp:my_tool_tokens', …(1) ]
  [
    "temp:my_tool_tokens",
-   "my_tool_tokens",
+   "apiKey_ab718306e1907ce2__existing_exchanged_credential",
  ]

AssertionError: expected [ …(2) ] to deeply equal [ 'shared_tool_tokens' ]
-   "shared_tool_tokens",
+   "apiKey_ab718306e1907ce2_apiKey_ba7390300e46243a_existing_exchanged_credential",
+   "http_178204f758fb78d5_apiKey_ba7390300e46243a_existing_exchanged_credential",

AssertionError: expected [ Array(1) ] to deeply equal [ 'tool_a_tokens', 'tool_b_tokens' ]
-   "tool_a_tokens",
-   "tool_b_tokens",
+   "apiKey_ab718306e1907ce2_apiKey_ba7390300e46243a_existing_exchanged_credential",

The fourth case pins the empty-string fall-through, which that mutation does not change. I proved it separately by widening the guard to if (this.credentialKeyOverride !== undefined):

AssertionError: expected [] to deeply equal [ '' ]

Manual End-to-End (E2E) Tests:

I built one OpenAPIToolset with two operations and a toolset-wide credentialKey, seeded temp:shared_toolset_tokens, and ran both tools against a real local HTTP server that echoes its headers.

tools: echo_one, echo_two
x-api-key sent: ["shared-key","shared-key"]
session state keys: ["temp:shared_toolset_tokens","shared_toolset_tokens"]

Before the fix, the same run ends with ["temp:shared_toolset_tokens","apiKey_ab718306e1907ce2__existing_exchanged_credential"].

No new integration test is needed. tests/integration/tools/openapi_credential_cache_test.ts from #864 already drives real OpenAPIToolset tools over HTTP through the slot this change moves, and it stays green.

Pre-submit:

npx eslint <the four changed files>   # clean
npx prettier --check <the four changed files>   # clean
npm run ts:check   # 5 pre-existing errors in this test file, unchanged by this PR

The five {type: 'apiKey'} errors in tool_auth_handler_test.ts are on lines 80, 97, 139, 167 and 179, all in tests that predate this branch. I confirmed the count is identical with my test hunk stashed.

Checklist

[x] I have read the CONTRIBUTING.md document.
[x] I have performed a self-review of my own code.
[x] I have commented my code, particularly in hard-to-understand areas.
[x] I have added tests that prove my fix is effective or that my feature works.
[x] New and existing unit tests pass locally with my changes.