Observe current executor connections in Core credential lists

[SaladDay]

The Core executor credential list shows key metadata without indicating whether its Environment has ever enrolled or currently has an authenticated connection. Add a required connection observation with the bound key, enrollment time and last heartbeat. Read metadata in one closed snapshot, then check current Core authority and the actual gateway peer; rotation, revocation or retirement cannot inherit an old socket's connected state.

Focused PostgreSQL, controlled gateway race and client tests passed. Independent authority review found a canonical UUID mismatch for valid alternative path spellings; the correction uses the resolved Environment identity and has negative-control, route and PostgreSQL regressions plus coordinator self-review. Core schema, client projections, generated API reference and the browser credential-list fixture are updated; public and machine schemas remain unchanged.

Complete local server make check passed on 35dcc1e4, including the final #180 correction: 670 client and 414 Web tests plus the required Go/PostgreSQL, schema/generation, adapter, type/build and Rust checks. The server gate uses the approved browser exclusion; both exact-head CI workflows, including the complete browser-inclusive gate, passed. The previous docs-freshness failure is fixed and retained in the evidence. Real install/connect/rotate/disconnect acceptance remains required.

Stacked on #180. No new route, migration, enrollment/write operation or execution state. No intermediate release.