Credentials: the startup encryption migration still reads partitions directly under database enforcement

#943 moves the workflow runner, both retention sweeps and the job queue worker onto a per-tenant listing when `Tenancy:DatabaseEnforcement` is on, and closes #877. The startup credential migration (the one #880 extends with the `enc:v1:` prefix) still lists tenants the old way, so with enforcement on it fails and stored credentials stay unencrypted.

### Done when
- The credential migration uses the same tenant listing as #943.
- A test with enforcement on fails before the change and shows a named tenant's credential encrypted after it.

Follow-up to #877 and #880.

Start at the startup credential migration and compare its tenant-listing path with the per-tenant listing introduced by #943. Add the enforcement-on regression test described in the issue, then verify that a named tenant’s stored credential is encrypted after the migration.

Written by the indexing model from the issue text.