[kvlonge]

Why

contract diff --from <target> and contract generate --from <target> describe <target> as the namespace to inspect, but project compilation also resolved that target's execution credentials. Read-only inspection therefore failed when the active connection could read the namespace but the inspected target's credential was intentionally unavailable.

The same unnecessary credential resolution occurred again during post-write validation.

Changes

• compile the inspected target namespace with the already-resolved active connection
• use the same active connection during repository-write validation
• cover both diff and generate/write when the inspected target's credential contains an unavailable environment variable
• audit other cross-target features and confirm defer operations already use the active connection, while direct diff and clone intentionally use the documented destination connection

Verification

• uv run pytest tests/integration/src/sqlbuild/cli/commands/main/test_contract_command.py -n auto --dist loadfile (12 passed)
• make check-ci
• read-only contract inspection and generation against a downstream production namespace through its active developer connection
• public repository hygiene scan