How to run Gardener integration tests for shoot creation without production credentials?

The Gardener project provides an integration test script that runs Ginkgo tests against a local or CI environment, optionally generating JUnit reports. The script configures test flags, including a timeout when running in Prow, and invokes go test with GO111MODULE=on. However, exercising the shoot creation feature typically requires credentials for the target cloud provider, which poses a security risk when running tests outside production. The goal is to validate the shoot creation integration logic without exposing real credentials, perhaps by using a fake provider, envtest cluster, or mocking the cloud API. Constraints include keeping the test reproducible locally, avoiding external secrets, and still exercising the Gardener controller manager and API server. It is unclear which environment variables or test flags allow skipping credential‑dependent steps, or whether a dedicated test suite exists for the shoot creation feature that works with envtest.

Specific questions:

• How can I configure the integration test run to use a kind or envtest cluster instead of a real cloud provider for shoot creation?
• Which environment variables or test flags should be set to skip or mock credential‑dependent steps in the Gardener shoot creation tests?
• Is there a separate test target or label that exercises only the shoot creation reconciliation loop without provisioning actual infrastructure?