[AIGTWY-4880] Add account auth for CUJ5 with shared credentials

[andy-xu-db]

🥞 Stacked PR

Use this link to review incremental changes.

• stack/andy/aigtwy-4880-account-auth [Files changed] ← this PR
  • stack/andy/aigtwy-4880-budget-fixture [Files changed]
    • stack/andy/aigtwy-4880-budget-evidence [Files changed]
      • stack/andy/aigtwy-4880-budget-defaults [Files changed]

---

Summary

Match PR #930's dedicated-workspace authentication shape for CUJ5. The workflow supplies UCODE_TEST_WORKSPACE plus the shared CUJ service-principal credentials; the runner uses its standard workspace OAuth path and adds one account-scoped exchange for the account budget API.

Changes

• Keep mint_m2m_token as the existing workspace-only helper used by other integration jobs.
• Add mint_account_m2m_token for /oidc/accounts/{account_id}/v1/token, using the same client ID and secret.
• Accept CUJ5 workspace, account, budget, and model metadata from the workflow instead of hardcoding a target in the runner.
• Forward non-secret UG_BUDGET_* metadata and the minted account token only to pytest, while keeping credentials and caller-supplied tokens out of native agent processes and evidence.
• Preserve the bounded test deadline and interrupt grace period needed to restore a mutated budget.

Workflow contract

PR #911 declares the target in .github/workflows/integration.yml. It maps UG_CUJ5_WORKSPACE, UG_CUJ_SP_CLIENT_ID, and UG_CUJ_SP_CLIENT_SECRET in the same format as PR #930, then provides the account, budget, and model identifiers as CUJ5 job environment values. This PR contains no fixed CUJ5 target values.

Verification

• 19 runner tests passed.
• The complete stack passed 119 focused runner, contract, fixture, evidence, and Codex regression tests.
• Ruff, formatting, and diff checks passed.
• A previous live CUJ5 run verified workspace OAuth, account-budget mutation and restoration, and all seven journeys with the shared credentials.

[andy-xu-db]

Consolidated into #911, which now contains the complete CUJ5 integration test change as one commit against main.