Split credentials refactor out of #1225 into an independent PR

Summary

Split the credentials refactor (and the internal/configpaths refinements) out of #1225 so they can land ahead of the new registry/remote/config package.

Background

#1225 ("feat(config): add remote config package with credentials refactor") bundles three things:

1. the new registry/remote/config package,
2. a refactor of registry/remote/credentials, and
3. refinements to registry/remote/internal/configpaths.

The PR description states these "cannot be split without breaking compilation or tests." In practice the coupling is weaker than that: the production code is cleanly decoupled, and only two _test.go files tie credentials back to config.

Why a split is feasible

Production dependency direction is one-way: config → credentials.

• credentials/store.go exposes a registration hook — the ConfigFileLoader type, a package-level defaultConfigLoader, and the exported SetDefaultConfigLoader(). It imports nothing from config.
• config/config.go registers itself in init() via credentials.SetDefaultConfigLoader(...).
• internal/configpaths imports neither config nor credentials, so it can ship first with zero coupling.

The only credentials → config references are test-only:

• credentials/file_store_test.go and credentials/store_test.go use config/configtest.Config as a fixture struct. configtest is a standalone ~39-line package of JSON-shaped structs that imports nothing (not even config).
• credentials/file_store_test.go additionally blank-imports config (_ ".../config" // registers config loader) because those tests exercise NewStore / NewStoreFromDocker, which require a registered loader.

Nothing here breaks compilation without config.

Proposed work

1. Land internal/configpaths refinements on their own (independent, no coupling).
2. Land the credentials refactor without the config package by:
   • inlining or relocating the configtest fixture struct into the credentials test package (or a shared internal test helper), and
   • registering a stub loader via SetDefaultConfigLoader (or switching to NewStoreFromConfig) in file_store_test.go instead of blank-importing config.
3. Land the registry/remote/config package as a follow-up, swapping the stub test loader for the real config registration.

Benefit

Smaller, independently reviewable PRs; configpaths and the credentials refactor stop being blocked on review of the much larger config package.

Trade-off

The credentials tests get touched twice (stub first, real config later). If the priority is simply landing the config layer to unblock the signature package, the existing bundle in #1225 is reasonable — this issue tracks the split as the alternative for reviewability.

Refs #1225. Part of the feat/everything (#1130) v3 breakdown.