Process-wide cache of resolved CredentialSettings instances keyed by a hash of the merged credential section content. Resolver-matched entries are additionally keyed by the reference-identity hash of the resolver instance that produced the provider, so two callers with identical effective config that share a resolver instance also share one settings instance (and the token-layer cache inside the provider). Distinct resolver instances (even of the same type) get distinct cache entries — a custom resolver carrying instance state (e.g., per-host secrets) cannot leak its provider into another caller's chain. Inline credential sections that no resolver claims are cached under a single section-only key, so the inline-ApiKey path benefits from caching too.