A table of placeholder credential env vars is primed at startup, but what decides substitution is not resolved in this code.
What
A table now maps each of these command-line tools to the credential environment variables it reads and to stand-in values for them, covering GH_TOKEN and GITHUB_TOKEN, the full AWS set including container credential URIs, and the Google Cloud SDK token and application default credentials path. A startup step primes these and logs without failing if it cannot. What decides when the placeholders are substituted is not settled by the code that defines them.
Evidence
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
Strings lifted out of the shipped bundle, so the claim above can be checked against them.