refactor: Extract rebuildEvaluator and registerCredentialMappings

[keelerm84]

Summary

Second slice carved out of #720 (the re-anchor mechanism, SDK-2542), split for reviewability. A pure, behavior-preserving refactor that extracts two blocks out of envContextImpl into methods the synchronous re-anchor path will also call. Independent of the store-handover slice (#736); both are siblings off feat/concurrent-keys.

• rebuildEvaluator -- the evaluator-build block lifted out of startSDKClient, so the re-anchor path can rebuild the evaluator against the (handed-over) store without duplicating it.
• registerCredentialMappings -- the envStreams / handler / connection-mapper wiring lifted out of addCredential, so the re-anchor path can register a brand-new anchor's downstream routing on its own.

No behavior change. The one reordering: addCredential now adds the connection mapping at the top (inside registerCredentialMappings) rather than at the end.

Why the reorder is safe: it is not because c.mu hides it -- the connection map (envsByCredential) has its own lock, so a request can resolve the newly-added credential the instant AddConnectionMapping returns, while addCredential still holds c.mu. Rather, every env field such a request then reads -- GetClient, GetEvaluator, GetStreamHandler, GetInitError -- takes c.mu.RLock, so the request blocks until addCredential completes and observes the same committed state regardless of where the mapping was registered inside the lock. The pre-existing window in which a credential is routable before its async SDK client is installed (startSDKClient is go-spawned and blocks on c.mu in both versions) is unchanged. The only new sub-window -- credential routable before eventDispatcher.ReplaceCredential repoints forwarding -- is benign: the event-relay endpoint converges under its own lock and forwards under the new anchor either way, and during a rotation both the old and new anchor keys are valid (grace period).

Verified with go test -race ./internal/relayenv/, go vet, and make lint.

Split sequence

PR 2 of a 4-slice split of #720: store handover (#736) -> relayenv refactors (this PR) -> credential rotator deferred-flip API -> synchronous re-anchor core.

---

Note

Medium Risk
Touches credential routing and evaluator setup on the hot path for SDK key rotation; intended as no-op refactor but reorders when credentials become routable relative to event forwarding under c.mu.

Overview
Behavior-preserving refactor in envContextImpl that pulls two blocks into dedicated helpers so an upcoming synchronous re-anchor path can reuse them without duplicating logic.

registerCredentialMappings centralizes downstream routing for a credential: envStreams, per-stream HTTP handlers, and connectionMapper. addCredential now calls it first, then keeps anchor-only work (async startSDKClient, metrics/event ReplaceCredential). Connection mapping runs earlier in the lock than before (with stream/handler setup) instead of at the end of addCredential.

rebuildEvaluator holds the evaluator construction that used to live inline in startSDKClient (data store → evaluator options, including secondary key and big segments).

Comments were updated to describe the split; no new call sites beyond the extractions in this PR.

^{Reviewed by Cursor Bugbot for commit a535418. Bugbot is set up for automated code reviews on this repo. Configure here.}