Short-lived worker that resolves an opaque credential reference and invokes an authentication provider.

The child specification contains no secret material. Raw credentials exist only on this process' callback stack and in its linked provider process; neither is retained in gen_server state or emitted as an error.