Emit the [AI-CREDENTIAL-STALE] line for any connected AI credential that has not succeeded in AI_CREDENTIAL_STALE_DAYS while something has tried and failed.

Lives beside the platform-quota watcher because it is the same detector — absence of an expected outcome — and shares its alert-token contract, its 20-hour dedupe and its dry_run-as-status behaviour. It is a different subject (creator AI keys, not platform API ceilings), so it is a separate route on a separate schedule rather than another kind in that sweep.