Derive classifying families' serving and policy fact types from authMethod, preserving the legacy credentialType and refresher path. Declare unknown-auth-method as a fixed refusal and release 0.29.1 without changing persisted roster types.

Replace the old tests that gated on id type or delegated missing methods to policy: the vault contract makes credentialType a hint and requires missing or unknown methods to be refused before provider checks. Add real vault row fixtures, custody and consumer regressions, hub coverage, and a 0.29.0 roster compatibility check.

Verified remotely: full suite (2210 pass, 20 skip), build, TypeScript 7.0.2 typecheck, lint (2 existing response-clocks warnings), and the client 0.6.2 floor (417 pass, 27 skip plus build/typecheck). The new real-apikey custody regression failed before the fix with an empty credential inventory. Hooks skipped because their build/lint/typecheck commands already ran on the build server.