[zqr10159]

Summary

Backport the fixes from #4516 to the 1.9.1 release branch:

• Preserve masked credentials encrypted with a custom AES key and keep credential validation fail-closed.
• Harden Linux CPU template output parsing across distributions, including legacy mawk compatibility.
• Keep the website contract test correct for Git checkouts and source archives.

Validation and CI

• The synchronized tree matches the dev fix: head b9b5801 and tree 1cc6e00a7aa8049a4b182e5d122dcfe816d15957; the dev head had 5/5 checks passing.
• 22 targeted tests and Checkstyle passed on this release sync branch.
• Full release artifact build and validation are still pending. Release-branch-specific CI has not yet run, so the dev checks are same-tree evidence rather than release-branch CI results.