fix(agent99): materialize credential target exit code

agent99-signoz-credential-provisioner.ps1

@@ -73,12 +73,15 @@ function Invoke-FixedTargetProgram {
       throw "target_timeout"
     }
     $process.WaitForExit() | Out-Null
+    $process.Refresh()
+    if (-not $process.HasExited) { throw "target_exit_state_unavailable" }
+    $exitCode = [int]$process.ExitCode
     $stdout = if (Test-Path -LiteralPath $stdoutPath) {
       ([IO.File]::ReadAllText($stdoutPath, [Text.Encoding]::UTF8)).Trim()
     } else { "" }
     if ($stdout.Length -gt 8192) { throw "target_output_too_large" }
     try { $result = $stdout | ConvertFrom-Json } catch { throw "target_receipt_invalid" }
-    if ($process.ExitCode -ne 0 -or [string]$result.terminal -eq "failed") {
+    if ($exitCode -ne 0 -or [string]$result.terminal -eq "failed") {
       $code = if ($result.PSObject.Properties["error_code"]) { [string]$result.error_code } else { "target_failed" }
       throw $code
     }

scripts/ops/tests/test_agent99_signoz_credential_provisioner.py

@@ -151,6 +151,10 @@ def test_agent99_entrypoint_is_fixed_and_never_transports_secret() -> None:
     assert '$ExpectedWorkItemId = "P0-OBS-002"' in source
     assert '$ExpectedRuntimeFileCount = 20' in source
     assert '"sudo -n /usr/bin/python3 - --mode $($Mode.ToLowerInvariant())"' in source
+    assert "$process.Refresh()" in source
+    assert 'if (-not $process.HasExited) { throw "target_exit_state_unavailable" }' in source
+    assert "$exitCode = [int]$process.ExitCode" in source
+    assert '$exitCode -ne 0 -or [string]$result.terminal -eq "failed"' in source
     assert "-RedirectStandardInput $TargetProgram" in source
     assert "secret_in_transport = $false" in source
     assert "Invoke-Expression" not in source