Merge the two dropped-source loader tests into one that fails fast instead
of hanging to the vitest timeout, and reduce the membership boundary matrix
to commit and credential, loading at a commit so the key's commit slot is
actually exercised. Refresh and expiry stay covered by the in-flight tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>