Consolidate redundant runtime test coverage

[yyjeqhc]

Summary

Follow up on the test-infrastructure cleanup merged in #127 by consolidating semantically duplicate webcodex package tests without changing production behavior.

• replace repeated Auth/OAuth authority cases with table-driven matrices
• consolidate Connector validation failure and monitor-state fixtures
• reduce duplicate MCP/HTTP generic-tool transport and OAuth-scope coverage
• consolidate ToolRuntime project I/O, Job lifecycle, Workflow Session, and authority tests
• share deterministic helpers for Agent request readiness, fake session-scoped Jobs, process dispatch, and repeated ledger setup
• keep lifecycle/transport behavior owned by the stronger canonical suites instead of repeating the same execution path in multiple files

The final diff is test/test-helper only across 22 files. No production source, schemas, runtime behavior, permissions, timeout policy, or public tool contracts are changed.

Review fix

Pre-PR review found one real coverage regression in the initial consolidation: the combined project-read path-boundary test retained ../ traversal but dropped several absolute/deep-traversal cases previously owned by separate tests.

A focused follow-up commit restores the complete fail-closed matrix while keeping one consolidated test:

• read_file: parent, nested parent, absolute, and deep parent traversal
• list_project_files: absolute + parent traversal
• project_overview: absolute + parent traversal
• search_project_text: absolute + parent traversal plus structured invalid_search_request evidence
• every rejected case proves zero Agent dispatch

Review commit: 8cd87759 (Preserve project path coverage in test consolidation).

No other correctness blocker was found in the consolidation review.

Why

The previous suite had accumulated many tests that repeated the same fixture construction, polling loops, transport wrapper, or authority assertion with only one changed parameter. That made contract ownership harder to see, increased test maintenance cost, and amplified scheduler-sensitive polling boilerplate.

This follow-up keeps representative/canonical contract owners and expresses genuine input/state matrices directly, while positive async readiness helpers now use bounded wall-clock deadlines rather than fixed yield counts where appropriate.

Validation

• focused restored project-path boundary regression — 1 passed / 0 failed
• cargo test -p webcodex — 2770 passed / 0 failed / 0 ignored
• cargo fmt --all -- --check — passed
• git diff --check origin/main...HEAD — passed
• git diff --check — passed
• bash scripts/test_inventory.sh --self-test — 2 passed
• bash scripts/test_inventory.sh — passed

Base: current main @ e2c0f9a8 (Measure generic model-facing tool ergonomics (#128)).