## W4: probe effective release-channel credentials

Closes BigscreenVR/spt-bs-releases#312. Refs BigscreenVR/spt-bs-releases#318.

Root cause: aggregate `gh auth status` can fail for a stale stored login even when the effective inherited GH_TOKEN can read the release channel. Update fetch previously let that unrelated failure veto its actual carrier.

Update fetch now runs bounded `gh release list --repo <resolved channel> --limit 1 --json tagName` through the same inherited environment and command runner as downloads. Success admits fetch without consulting aggregate status. Missing gh stays GhCliRequired; a positive-probe timeout is distinct GhProbeTimeout. A failed read remains GhAuthRequired and may name only a sanitized failed host/account explicitly reported by gh. Optional diagnostics consume the remainder of the original ten-second budget, cannot rescue a failed read, and never render raw auth output or token bytes. Reported account metadata is diagnostic, not proof that account caused the failure.

No credential retrieval/mutation, gh auth switch/logout, adapter Auto-policy change, signed metadata/artifact verification change, or update-apply authority change.

## Verification and provenance

Head c248cb84a399fd29ef1e822e2344fa030ab3f13d on landed main5ddf55a6. Original W4 commit9e0a2e9e was rebased onto W3 ff55d152 as f4079c75; the sole append-only REQ conflict preserved both requirements. Final rebase adds only docs/INFRA-REGISTER.md from PR243 (measured diff); Doyle explicitly ruled the Rust battery remains valid across that documentation-only delta. No Rust/version/fixture delta between tested f4079c75 and final head.

Receipts: `.spt/preserved/318/todlando-w4/`.
- `red.json/log`: all three new subprocess regressions failed before the source fix (native100; one outside-filter skip).
- `rebase-tests.json/log`: refreshed Windows credential units plus full composite_e2e passed12/12 (native0;784 outside-filter skips). Real child-local synthetic GH_TOKEN and selected-repo checks prove inherited effective credentials. Integration stages valid signed metadata and expected artifact bytes despite stale aggregate auth; denied and timeout cases cannot download/stage.
- `rebase-clippy.json`: workspace/all-targets clippy with -D warnings0. `rebase-build.json`: own spt+xtask build0. These ran on f4079c75 before the docs-only rebase.
- `rebase-gen.json`, `rebase-docs-check.json`: own fresh xtask gen/check0 on final head. `publish-trace.json/log`:940/940 complete, zero findings. REQ-UPDATE-EFFECTIVE-CREDENTIAL-PROBE is scoped and tagged at doc/impl/unit/int evidence.
- `smoke.json`, `smoke-commands.json`: four actual private-home CLI cells passed before rebase. Effective credentials admit download but deliberately invalid signed metadata still refuses; failed effective read, bounded timeout, and missing executable remain separate. Valid signed staging is the integration proof, not this invalid-metadata smoke.

Smoke binary SHA256 `4bde593ecf3df12059e5c0fd03aab471b7e6bad2a392ed0ed6e90abfc4b08ae4` was built from final W4 source before the original commit/rebase, not a commit-stamped rebuild. The refreshed integration executes the rebuilt CLI. No real credentials or network required for these fake-carrier regressions.

## Resource custody and cleanup

Initial post-rebase native admission refused56.68GiB free against96GiB; no Cargo ran before recovery. Doyle authorized removal of our landed W1/W2/W3 targets: native Get-Item showed real dirs; repository-wide inbound reparse scan had no matches/errors. Only those target subtrees were removed; worktrees retained. Actual free56.68->96.71GiB (+40.02GiB). Foreign gate/release/Hertz pools and runner _work untouched. Receipts: landed-pool-classification/recovery.json.

Own W4 pool reclaimed before the final battery, claim identity refreshed after docs rebase, then released0 (`publish-release.json`). Own target retained. Private smoke and final runner home/tmp cleaned; final candidate process census empty (`publish-cleanup.json`). No resident credentials/daemon or firewall changes. One own Cargo at a time, jobs2; no cargo fmt.

Scope: local Windows proof, not a real-account field rollout or full milestone acceptance. Doyle owns independent gate and ff-only landing.