Anton Panasenko bd5a836567 Refresh remote exec-server credentials after unauthorized responses (#55987) ...

## Why

Remote registry requests need to recover when credentials are rejected or rotated while `exec-server` is running. Concurrent requests should reuse refreshed credentials rather than refresh the replacement token again.

## What changed

- Add an `AuthProvider` recovery hook and retry registry registration, connection, and harness-key validation once after a `401` when the provider supplies replacement credentials.
- Use live ChatGPT authentication for remote `exec-server` and guard proactive and unauthorized refreshes so concurrent callers share the completed refresh.
- Allow executor credentials to retry when the parent has already supplied a valid replacement.
- Keep connection authentication, refresh, and retry within the original connection deadline.

## Testing

Add coverage for concurrent refreshes, stored and parent-supplied credential rotation, refresh failures, retry limits, and connection deadlines, plus a CLI integration test for refresh and credential reload in a running executor.

GitOrigin-RevId: 9ed533e410762c7ac8b7c0c30bb93fd20d96778b

2026-10-21 21:05:08 +00:00

..

auth_refresh_tests.rs

Refresh remote exec-server credentials after unauthorized responses (#55987)

2026-10-21 21:05:08 +00:00

pid_namespace_tests.rs

Reject sandbox-writable bubblewrap executables from PATH (#51211)

2026-10-06 00:58:19 +00:00