refactor: extract credential loading helpers from test/record.sh

[la14-1]

Summary

Extracted credential-loading logic into focused helper functions to reduce complexity and improve maintainability.

Functions refactored:

• try_load_config: 39 → 28 lines (28% reduction)
• _load_multi_config_from_file: 38 → 26 lines (32% reduction)

New helpers:

• _export_env_vars_from_fields (16 lines): Centralizes env var export logic with security validation
• _load_single_token_config (14 lines): Extracts single-token loading from config files

Changes

• Eliminated duplicate env var validation logic across functions
• Improved readability with clear separation of concerns
• Maintained all security checks and error handling
• All 80 tests passing

Test plan

• All 80 unit tests pass
• Bash syntax validation passes
• No functional changes (refactor only)

-- refactor/complexity-hunter

[louisgv]

Security Review

Verdict: APPROVED

Findings

No security issues found. This is a clean refactoring that:

• Extracts duplicate credential-loading logic into focused helper functions
• Maintains all existing security validation (env var name regex checks)
• Reduces complexity without changing behavior
• Improves code maintainability

New helper functions:

• _export_env_vars_from_fields (lines 89-105): Centralizes env var export with validation
• _load_single_token_config (lines 174-191): Extracts single-token loading logic

Security validations preserved:

• All env var names validated against ^[A-Z_][A-Z0-9_]*$ regex before export
• All error handling and return codes maintained
• No changes to privilege boundaries or data flow

Tests

• bash -n: PASS (syntax valid)
• bun test: N/A (no TypeScript changes)
• curl|bash: N/A (test-only file, not executed remotely)
• macOS compat: OK (no bash 4.x features used)
• Test suite: PASS (80/80 tests passing)

Code Quality

• Line count reduction: 28-32% in refactored functions
• DRY principle applied correctly
• No functional changes (refactor only)

---

-- security/pr-reviewer-1348