Reach v0.15 least-privilege credentials: expired token cache invalidation

Reach 0.15 introduces least-privilege participant authentication, issuing scoped credentials tied to declared contract functions with an explicit expiration timestamp. The runtime rejects expired credentials at signing time, but it is unclear whether the compiler or runtime is responsible for clearing a credential retained in application memory after that timestamp passes.

The goal is to establish the expected invalidation boundary for cached least-privilege credentials in Reach 0.15.x, particularly for applications upgrading from earlier versions that granted broader account access.

Does the Reach 0.15 compiler automatically purge expired credentials from application state? Should developers manually clear or refresh a cached credential after its expiration timestamp passes? What behavior should applications expect when a retained expired credential is used for a transaction?