The overview keeps the store invariant, the mTLS exception and the
minter/reader/renewal contract. The table of every credential and the
operating notes (forge token checks, re-creating agents, revoking a queue
credential, store login retries) move unchanged to credentials-reference.md,
and the links that asked where a credential lives point there.
