Session-based connectors acquire credentials at invocation time from CredentialResolver, manage transport lifecycle with cleanup guarantees, and never store credentials. Signed-off-by: Tyler King <tking@guildhouse.dev>