The provider descriptor and config protocol are pure modules already covered
by adversarial QtTests, but 22 static fragment assertions still pinned their
source text. Those assertions fail on a rename that changes nothing and pass
on an edit that changes behavior, so they cost refactoring safety without
adding protection.

Each removed fragment was verified by breaking the behavior it described and
confirming an existing QtTest went red. Display-text bounding and credential
redaction for descriptor titles and descriptions had no runtime coverage, so
tst_provider_descriptor.qml gains a test for them; it fails when the 120/500
limits are widened and when cliMessage is downgraded to boundedDisplayText.

Assertions about configProviders.qml wiring, lifecycle, and security
invariants are unchanged: static checks remain the documented tool there.

Documentation: docs/development.md records the deliberate-break criterion for
adding or keeping a static assertion. No user-visible change, so CHANGELOG is
untouched.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>