fix: harden Pi management readiness

backend/src/pi/provider-credentials.ts

@@ -53,6 +53,8 @@ export function canonicalPiProvider(provider: string | undefined): string | unde
   return value;
 }
 
+export type PiCredentialStatus = "present" | "missing";
+
 export interface CredentialFsOps {
   lstat(path: string): Stats;
   open(path: string, flags: number): number;
@@ -172,3 +174,22 @@ export function buildPiChildEnv(opts: {
   }
   return env;
 }
+
+/** Report only whether the selected hosted provider has a usable credential source. */
+export function piProviderCredentialStatus(opts: {
+  provider?: string;
+  credentialFile?: string;
+  credentialValue?: string;
+  authProviders?: ReadonlySet<string>;
+  fsOps?: CredentialFsOps;
+}): PiCredentialStatus {
+  const provider = canonicalPiProvider(opts.provider);
+  if (!provider || LOCAL_PROVIDERS.has(provider)) return "missing";
+  if (opts.authProviders?.has(provider)) return "present";
+  try {
+    buildPiChildEnv({ ...opts, ambient: {} });
+    return "present";
+  } catch {
+    return "missing";
+  }
+}