Add regression coverage for OIDC service-account cache isolation

[Copilot]

CI workflows may switch OIDC service accounts between pull and push operations. Cached tokens must remain isolated by service slug so each account receives its own token.

• Cache identity

  • Retains API host, Workspace, and service slug as the cache key.
  • Leaves credential-provider precedence unchanged.

• Regression coverage

  • Exercises sequential authentication with pull and push service accounts.
  • Confirms each service slug triggers a separate exchange.
  • Confirms returning to the first service account reuses its cached token.