This is a prerequisite ticket only with no-public-API changes. It de-risks the feature by landing the mechanical interface alignment on its own, so the follow-up PRs only add new surface: the options interface of credential/encryption setters and the ext/awsauth adapter.

This ticket re-shapes the built-in AWS credential interfaces to match aws-sdk-go-v2:

`Value` drops `ProviderName` and gains the SDK-v2 fields: Source, CanExpire, Expires and AccountID (exactly the field set WRITING-38224 specifies for the Retrieve return struct).

The old Provider interface had `Retrieve() (Value, error)` plus `IsExpired() bool`, with a separate `ProviderWithContext` shim for `RetrieveWithContext(ctx)`.

These migrate into one method: `Retrieve(ctx context.Context) (Value, error)`. Every concrete provider (assume_role, ec2, ecs, env, imds, static) is updated to the new signature.

A new `Value.Expired()` method derives expiry from Expires/CanExpire. Providers/chains no longer track expiry separately.