test coverage for credential boundary

[swelborn]

i don’t like this, as it is super mocked up + claude-generated. we should revisit test strategy later…

---

This is part 22 of 23 in a stack made with GitButler:

•  23  use historical=True as a fallback if job not found #52
•  22  test coverage for credential boundary #51 👈
•  21  remove "force" option for cache shutdown #50
•  20  client/service/workflow changes for IRI token delegation changes #49
•  19  add cache table to track caches #48
•  18  authenticated principal + encrypted delegated-credential capture #47
•  17  OIDC transfer ownership and delegated user credentials #46
•  16  WIP for shared cache shutdown #45
•  15  add jobspec override #44
•  14  add mostly claude-gen usage example package #43
•  13  ability to share a cache amongst different transfers #42
•  12  add precommit hook for checking openapi client drift #40
•  11  pin python version to 3.14 #41
•  10  build frontend image in CI #39
•  9  add frontend #38
•  8  add frontend client (autogenerated) #37
•  7  lazily construct settings #36
•  6  add autogenerated client #35
•  5  add alembic #34
•  4  add ability to get logs from v2 api services thru iri #29
•  3  functional core tests for transfer and producer #30
•  2  api with durable execution and saga #28
•  1  deps for v2 #27