Docs: credentials and sessions share the server's data root #279

What

The isolation recipe redirects the data root without saying that provider credentials live there; two builders lost auth (harness-led)

Severity: minor. Seen by the builders of apps: 02, 06.

Upstream (pinned v2.0.29)

Credentials sit in the SQLite credential table of opencode.db under the data root, the same DB as sessions. XDG_DATA_HOME or OPENCODE_DB move both, and nothing separates them. Upstream's own desktop tests isolate by setting all four XDG_*

Proposed

One sentence in the isolation section, matching upstream: credentials and sessions share the data root, so redirecting it means a fresh login.

Source: internal DevEx evaluation of 0.9.0-preview.10 on Windows, Linux and macOS, 2026-10-14 (finding DX-11).