Cover the work identity path end to end against the Okta emulator

A selfhost scenario runs the whole thing through the product: link via a real
OIDC sign-in, connect with no subjectToken in the payload, call a tool. Both
emulator ledgers carry the proof -- the sign-in, executor's own code redemption,
the exchange and the redemption -- and the MCP server sees no authorize request.

Renewal past ID-token expiry is not asserted here: the Okta emulator's token
lifetimes are compiled-in constants with no seed knob to compress them. That
claim is proven hermetically in the SDK suite instead.

Author: RhysSullivan