richardopenai c48785a9b7 Stop Noise relay recovery on rejected executor credentials (#59750) ...

## Why

Registry `401` responses during harness key validation previously produced generic relay resets, causing recovery to retry rejected executor credentials instead of surfacing the authentication failure.

## What changed

- Send an authenticated Noise handshake rejection for registry `401` responses without opening an application transport.
- Propagate the rejection as `EnvironmentRegistryAuth` and preserve it in the terminal connection state so recovery stops with a specific authentication error.
- Preserve registry HTTP status codes so `403` responses for stale harness grants and transient service failures can continue through recovery.

## Testing

Add tests that reject tampered authentication rejections and exercise session recovery: `401` stops after one rejected recovery attempt, while `403`, `502`, and `503` retry with fresh harness grants and reconnect successfully.

GitOrigin-RevId: 9a55412e583146c094948618c7c9aeb4fb4b953e

2026-11-05 22:03:55 +00:00

..

auth_rejection_tests.rs

Stop Noise relay recovery on rejected executor credentials (#59750)

2026-11-05 22:03:55 +00:00

registration_retry_tests.rs

Stop Noise relay recovery on rejected executor credentials (#59750)

2026-11-05 22:03:55 +00:00