cloud: cover Azure sovereign authority, override, workload-identity and managed-identity expiry edge cases

[smiggleworth]

Gap cloud-26 · missing-coverage · confidence: verified · tracked in #242
Baseline: Midge 7d39f86 (0.1.1) vs Pants 2507c66. Midge paths are relative to the midge repo, Pants paths to this repo. Midge behavior is used as the proxy for the not-yet-extracted lsm-spec behavioral contract.

Prior: G10 (partially fixed: code is present, tests are missing)

Midge: src/storage/providers/azure.rs tests should_derive_sovereign_authority_when_blob_endpoint_identifies_cloud (:3116),
should_preserve_explicit_authority_override_given_sovereign_blob_endpoint (:3186),
should_reject_empty_azure_workload_identity_assertion (:3230), should_reject_missing_or_invalid_managed_identity_expiry (:3323).
Related: should_reject_insecure_or_malformed_azure_authority_host (:3258),
should_ignore_blank_azure_environment_credentials_when_selecting_default_chain (:3210),
should_send_legacy_secret_header_when_using_msi_endpoint, should_send_metadata_header_when_using_vm_imds_endpoint.

Pants: src/Pants.Core/Cloud/Internal/Providers/Credentials/Azure/RefreshingAzureTokenProvider.cs has sovereign derivation
(usgovcloudapi → login.microsoftonline.us, chinacloudapi → login.chinacloudapi.cn) at :252-271, the override at :254-258, and authority
validation at :273-288. An empty federated assertion is rejected at :123-127. Managed identity requires an absolute expires_on that
lies in the future (:196-199, :326-367). Blank environment values are ignored at :407-408. MSI_ENDPOINT/IMDS headers are set at :177-192. The tests in
test/Pants.Tests/Cloud/AzureCredentialSourceTests.cs always set AZURE_AUTHORITY_HOST=https://authority.example.test
(lines 85/125/155/180/247), so sovereign derivation never runs. There are no empty-assertion, MI-expiry, malformed-authority,
MSI_ENDPOINT, or VM IMDS header tests. ShouldResolveManagedIdentityWithEndpointSpecificHeader covers IDENTITY_ENDPOINT only.

Why it matters: in Gov and China clouds, a wrong authority breaks authentication. A managed-identity token without an expiry would be cached indefinitely.

Acceptance criteria:

• With AZURE_AUTHORITY_HOST unset, *.blob.core.usgovcloudapi.net sends the token POST to login.microsoftonline.us/<tenant>/oauth2/v2.0/token, and the China endpoint sends it to login.chinacloudapi.cn.
• An explicit AZURE_AUTHORITY_HOST takes precedence over a sovereign endpoint. Authorities that are non-HTTPS, contain userinfo, a path, a query, or a fragment, or have surrounding whitespace are rejected with no request sent.
• A whitespace-only federated token file fails before any HTTP request.
• Managed-identity responses with no expires_on, a non-numeric expires_on, or a past expires_on fail. Also cover an expires_in-only response.
• MSI_ENDPOINT sends Secret and api-version 2017-09-01. VM IMDS sends Metadata: true and 2019-08-01.
• Whitespace-only AZURE_TENANT_ID/CLIENT_ID/CLIENT_SECRET/FEDERATED_TOKEN_FILE make the lightweight chain select managed identity.