[Stephen Belanger (Qard)]

A resource's bearer token did not fully determine its request scope. The trace queue chose endpoint routes and missing organization headers from shared login state at flush time, while dataset operations used configured routes even after login selected an organization-specific data endpoint. Project lookup caching also ignored credentials, and capability caching was shared across all routes.

Capture an immutable credential scope in each span, experiment, dataset, and pagination handle. Logged-in builders capture the selected organization and routes; explicit builders capture their credentials and configured routes independently of shared login. Resource adapters and queued commands carry that same scope through registration, lookup, preparation, merging, and upload. Experiment API calls now preserve the explicit organization header too.

Project and capability caches and upload groups use the full scope: token, organization ID/name, control URL, and data URL. Successful lookup caches are bounded to 1,024 entries each; eviction repeats a lookup rather than retaining unlimited tenant credentials. Debug formatting omits scope credentials and routes.

Stacked on #123. Public generic handles and remaining finished-span behavior are addressed in subsequent layers; this PR changes request identity and routing without adding a second resource API. Planning notes remain local.

Validation:

• Three regressions failed on Replace buffered dataset spans with typed resource writes #123 and pass here: explicit resources after session population, logged-in versus explicit dataset routes, and organization-header isolation.
• Seven focused scope tests cover those cases plus identical credentials on different data routes, token-specific project authorization, experiment clone/span inheritance, and debug redaction.
• Full unit/integration and doctest suites passed; with the final focused addition, 275 unit/integration tests and 9 doctests pass (one existing integration test and four doctests ignored).
• Strict Clippy, rustdoc, formatting, and git diff --check passed.