#9862 fix(release): run pinned async versions on their own variables, map CLI key-creation errors, show GitLab tokens as the current block

Summary

• An async run pinned to a deployment version that predates variable snapshots runs with that version's own (empty) variables, matching a sync run of it, instead of the editor's current variables. Only explicit run.version async runs (new in #9854, not yet released) set a pin; unpinned async, schedule and webhook runs keep resolveDeployedRunVariables unchanged
• CLI login poll answers a rejected key creation with the shared status mapping (400 for validation, not 500)
• GitLab personal-token credentials render as the current GitLab block instead of the hidden legacy one
• PII Dockerfile: correct the tldextract cache comment (the /tmp volume is per task)

Scoped to what no other release-audit PR covers: crawl depth is on staging via #9860; workflow access middleware, route policies and CONTRIBUTING are in #9858. Firecrawl search sources handling is left out pending a product decision (the block never forwards sources today).

Type of Change

• Bug fix

Testing

• lib/integrations/credential-display.test.ts passes
• biome on changed files; type-check, audits and full suites in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)