#176 fix: credential helper TTL cleanup + full remove_member decommission

[Anonymous]

Originally created by: kumaakh

Summary

• #69 fix(T2.3): Auto-remove credential helper after token TTL expiry — scheduleCredentialCleanup() fires at expiresAt or 55-min default; re-provision cancels old timer first; cleanup failure is silent; wired into provisionVcsAuth() after successful deploy; adds 10 unit tests
• #72 fix(T2.4): Full decommissioning protocol in remove_member — adds idle check (blocks removal if member is busy, force=true bypasses), VCS auth revoke for remote members, SSH public key removal from remote authorized_keys, and credential cleanup timer cancellation; all steps are best-effort; adds 10 unit tests

Test plan

• [ ] CI green (815 tests passing locally)
• [ ] Credential helper is removed automatically after token expires
• [ ] remove_member refuses to remove a busy member without force=true
• [ ] remove_member revokes VCS auth and removes SSH key from remote on decommission

🤖 Generated with Claude Code

[Anonymous]

Ticket changed by: kumaakh

• status: open --> closed