Probe every active credential and mark the ones the platform says are dead.

Same auth as every other scheduled job in this service: Cloud Scheduler OIDC, verified by require_cron_oidc against CRON_OIDC_AUDIENCE and the CRON_SERVICE_ACCOUNTS allowlist (cron_auth.py:145-156). Nothing else can call it.

NIGHTLY, not hourly. These tokens die on a scale of months — the oldest dead one here expired in April — so an hourly sweep is 26 API calls an hour to learn nothing, against third-party rate limits, to shorten a detection window nobody is watching by 23 hours. Nightly also means a marked credential is excluded from the NEXT import cron run rather than the current one.

dry_run=true classifies and reports without writing, so the first sweep can be read before it marks anything.

Marks ONLY on a definite platform answer. A timeout, a 429 or a 5xx is recorded as undetermined and changes nothing — see credential_health_policy for why that distinction is the point of this job.