_evict_cached_clients now pops without closing (a concurrent caller may be mid-request on the shared client), so the two credential-refresh tests assert eviction instead of close().