[management] Fix what a second review found in the credential check

Four defects and two pieces of wording, from cubic's pass over the branch.

A provider that asks the proxy to skip TLS verification was checked with a
client that verifies it, so a self-hosted endpoint behind a self-signed
certificate was refused for the one reason its operator had already declared
they accept. Those records now save unchecked, alongside the other cases this
cannot speak for. Sending the credential over a connection management declines
to verify was the other way out, and a worse one.

A key pasted with surrounding whitespace passed its check and then failed every
request: the vendor call trims before building the auth header, the synthesiser
substitutes the stored value verbatim. The key is now stored in the form it
will be sent, so what was checked is what runs.

The proxy-guard test resolved api.openai.com for real before reaching its own
transport, and on a runner with no egress that lookup failed as an
UnreachableError too — so it passed while never exercising the socket guard it
is named for.

A DNS timeout said only that the lookup failed. It now says so as a timeout,
without borrowing the wording of a connection that was never attempted.

The create description promised more than the check delivers: for Bedrock the
runtime host is resolved but never contacted, so a public host that does not
answer is still stored. It says that now, and names the TLS exemption above.
The invalid-upstream message no longer quotes the URL back, which was the one
path in this feature that echoed what the operator typed.

The live suite's single-vendor scope and its dependence on vendor availability
are now stated where the tests are, rather than left to be rediscovered.

e2e/agentnetwork/credential_check_live_test.go

@@ -67,6 +67,13 @@ func liveCredentialCases() []credentialCase {
 // The good-key case matters just as much as the bad one: a check that refused
 // everything would pass a test asserting only the refusal, and would make the
 // product unusable.
+//
+// The suite asserts on the vendors themselves, so it inherits their
+// availability: the check blocks on 5xx and 429 by design, and a vendor outage
+// or a rate limit during a run fails "a good credential saves" with a
+// perfectly valid key. There is no retry here on purpose — a retry loop would
+// also mask the outage classification these tests exist to prove. Re-run the
+// job.
 func TestLiveProviderCredentialCheck(t *testing.T) {
 	cases := liveCredentialCases()
 	if len(cases) == 0 {
@@ -111,6 +118,12 @@ func TestLiveProviderCredentialCheck(t *testing.T) {
 // TestLiveProviderUrlCheck points a real credential at a host that is not the
 // vendor's API. It is the half of the split a wrong key cannot exercise: the
 // operator has to be told the URL is at fault while their key is fine.
+//
+// One vendor, deliberately. The transport classification under test happens
+// before any vendor is reached, so running it per configured vendor would
+// repeat the same code path and multiply the wall-clock of a suite that
+// already creates real records. cases[0] is whichever vendor the environment
+// supplies first.
 func TestLiveProviderUrlCheck(t *testing.T) {
 	cases := liveCredentialCases()
 	if len(cases) == 0 {
@@ -147,6 +160,9 @@ func TestLiveProviderUrlCheck(t *testing.T) {
 // TestLiveProviderUpdateKeepsTheWorkingKey is the state the check exists to
 // prevent on the update path: a rejected rotation that has already replaced
 // the credential would take a working provider down.
+//
+// Also one vendor: the behaviour is in the manager's merge, not in any
+// vendor's response, and each run creates and mutates a real provider record.
 func TestLiveProviderUpdateKeepsTheWorkingKey(t *testing.T) {
 	cases := liveCredentialCases()
 	if len(cases) == 0 {