Here's a note from one of our customer-facing architects:
I'm trying to load external credentials as metadata. Apparently, I can not push metadata that has a perm set and header all at once. I have to delete the perm set from the metadata for it to work. If I then resubmit the original metadata, it’s successful.
I have to do it twice, which is a bummer — deployment fails and I have to manually intervene.