fix(pi): read an app credential with one source call

[eersnington]

Each model call read the app's credential with two calls to the app's source: list(), then read(). 0.5.1 removed the credential cache, so both calls ran on every model call.

 async read(providerId: string): Promise<PiCredential | undefined> {
-	if (!(await this.list()).some((entry) => entry.providerId === providerId))
-		return undefined;
 	return toPiCredential(await this.#source.read(providerId));
 }

• The PiCredentialSource contract already says read returns undefined for a provider without a credential, so the list() check added nothing.
• Pi's { signal } stays in the store. The documented source is a credentials Actor handle (client.credentials.getOrCreate([...])), and its actions would receive the signal as an extra argument.

---

This is part 1 of 9 in a stack:

•  9  docs(agents): type the React example's root id as ConversationId #346
•  8  feat(pi): prefix Pi Durable's tables in actor sqlite #345
•  7  chore(pi): bump and test Pi Durable 1.1.0 #344
•  6  refactor(pi): type action ids with Pi's branded id types #343
•  5  refactor(sandbox-adapter): simplify sandboxEnv #342
•  4  refactor(pi): move databaseEnv into pi and version pi_file #341
•  3  fix(sandbox-adapter): stop waiting on aborted Daytona exec #340
•  2  fix(sandbox-adapter): stop Pi env calls when the run aborts #339
•  1  fix(pi): read an app credential with one source call #338 👈

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.