feat: carry managed Execute authority through BYOC

[abrichr]

Summary

Carry the exact one-run managed Execute authority through the customer-controlled Connector into openadapt-flow run.

• Parse and bind the managed dispatch to the exact run, bundle, and runtime inputs.
• Write the envelope to a private mode-0600, exclusive local file.
• Put the run-scoped bearer token only in the child process environment.
• Remove stale authority variables from every Connector child.
• Pin the permit endpoint to the enrolled control-plane HTTPS origin and exact route.
• Refuse every HTTP redirect before a bearer credential can leave that route.
• Advertise the exact managed_delivery_authority_v1 Connector capability.

Security properties

The token does not enter argv or the managed envelope. Managed jobs fail closed on run, bundle, input, provenance, endpoint, or capability mismatch. Existing ordinary BYOC jobs remain compatible.

Two independent reviews accepted exact commit 5a062f6023d485909102538c846ae7490967cbc7.

Validation

• 88 focused Connector and durable-authority tests
• Ruff
• mypy
• Exact Cloud-generated dispatch vector parsed by the real Flow contract

Integration

This PR requires OpenAdapt Cloud PR #225, which preserves the managed authority and gates its lease on the negotiated Connector capability. Do not activate the managed BYOC lane until both changes are deployed together.