DL-586

The git credential broker keys every scope-keyed structure by tenant (entries, negative, served, last, the singleflight key and the grant generation), re-checks the owner’s binding on every mint, and runs the background refresh under each entry’s own tenant; the mint limiter and backoff stay global

Status: Active (designer, 2026-10-19)