v1.18.1

Fixed

• Temporary credentials in the shared credentials file were read once and never again.
  lith signs with the AWS SDK's default chain, and the SDK's credentials cache re-retrieves only
  credentials that report an expiry. Verified against the pinned SDK (config v1.33.4): temporary
  keys with a session token, whether exported as environment variables or written to
  ~/.aws/credentials by a SAML/SSO helper, come back with CanExpire=false. So the SDK kept the
  first set for the life of the process, a helper rotating the file was never seen, and the
  mount began failing every uncached read with EIO when that first set expired — an hour in, for
  a typical SAML role session.

  lith now re-reads the credentials file every 5 minutes when the credentials in it are
  temporary, so a rotated file is picked up without remounting. The interval is a third of the
  shortest session STS issues (15 minutes), not a tuned value. Instance roles, IRSA / Pod Identity,
  SSO and assume-role profiles and credential_process already renewed themselves through the SDK
  and are unchanged.

• lith_prefetch_evidence_clamped_total's help said it was "zero unless
  --readahead-evidence-ratio is set" — stale since #368 made the ratio region-derived and on by
  default in-region. An operator on an in-region mount reading that help would conclude the
  counter could not apply to them, on exactly the mounts where it does. It now says what the
  counter answers: when it is high, the evidence gate and not the divisor bounds windows on that
  mount. Found while working out whether #312's idle handles cost anything, which is the question
  this counter decides.

• --memory-limit's docs row now carries the measurement
  (#314): the configuration that was OOM-killed
  before (a 20 GB tier on a 33 GB box) survives in both reps on v1.18.0, RSS plateauing at 28.8 GB
  against a 29.7 GB limit, with no measurable wall cost on a link-bound workload. Stated as "free
  on a streaming workload", not "free" — concurrent GC CPU was not captured. Also records that
  the limit is exported as go_gc_gomemlimit_bytes, which the row previously omitted.

Added

• A startup warning, a doctor warning, and a specific error for expired credentials. A
  session token in the environment cannot be renewed by any running process, so lith now says
  so at startup and names the sources that do renew; lith doctor grades credentials by whether
  they will survive a long mount instead of passing anything that resolves. And when S3 rejects a
  request as signed with expired credentials (ExpiredToken, ExpiredTokenException,
  TokenRefreshRequired), lith logs it at ERROR — at most once a minute, with the remedy for the
  source in use — where before it was indistinguishable from any other failure. RequestExpired
  is deliberately excluded: it is clock skew, not credentials. docs/knobs.md gains a table of
  which sources survive a long mount.

• docs/knobs.md says what to do about unfair concurrent readers on a cross-region mount
  (#391), from a cell run for the purpose:
  us-west-2 reading us-east-1, lith v1.18.0, scripts and raw data in bench/x391/. With the
  evidence gate off — the cross-region default — 16 concurrent readers against a contended tier
  came out at spread 2.70–3.18, reproducing #391; any evidence ratio from 2 to 64 brought
  it to 1.17–1.63 and finished the job 15–30% sooner, on identical bytes.

  The default is unchanged, and the reason is the instrument. The gate is off cross-region
  because one fast whole-object reader measured 1.96× slower with it on. This cell's box streams
  ~375 MB/s per reader, latency-bound rather than NIC-bound, which is the configuration least able
  to show a ramp penalty — so its single-reader null (ratio 16 at 0.94–1.00×) does not refute it.
  Ratio 64 did show a penalty, ~3× in 3 of 5 reps, so the documented range is 2–16.

  And the first run missed the regime, which is recorded rather than dropped. Its working set
  fit in the tier, nothing was contended, and gate-off came out fair at 1.27–1.32. #391's
  unfairness needs the tier to be contended; the second run used --mem-cache 1GiB to make it so.
  Cost $6.33, of which $6.02 was inter-region transfer.