[alexgromero]

Issue #, if available:
Follow-up to #3809. Applies the publication fix from #3835 to resilient credentials.

Description of changes:
Aligns credential refresh resilience and invalid credential handling with the updated spec.

• Publish refreshed frozen credentials before their expiry to prevent concurrent callers from receiving old credentials.
• Scale refresh failure backoff with the remaining credential lifetime.
• Match ExpiredToken and ExpiredTokenException independently of HTTP status across retry modes, and remove InvalidToken from the invalid credentials error list. Legacy rules that specify both an HTTP status and an error code still require both to match.
• Treat login ValidationException as non-recoverable while preserving the original service exception.
• Accept expired credentials on the initial fetch. Subsequent expired refresh responses preserve the existing cache and enter backoff.
• Reject malformed expiration timestamps before caching initial credentials.
• Update the shared lifecycle cases, harness, and regression coverage.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.