Add end-to-end Workday DA setup orchestration

[Surendra Goutham (is-goutham)]

Summary

• orchestrate resumable Workday DA setup from package installation through signed-in runtime validation
• create Workday and Dataverse connections before binding runtime references and activating flows
• integrate the Add Dataverse flow authorization automation #306 authorization operation with preview/apply and exact-record verification
• offer enable-all or selected-topic activation without legacy ISU/RaaS guidance
• route only supported ESS DA HR agents into the setup and keep CEA package boundaries intact
• harden runtime package detection and SAML thumbprint reporting

Validation

• python -m pytest tests/setup tests/flightcheck/checks/test_workday_package.py tests/flightcheck/checks/test_workday_saml_certificate.py tests/scripts/test_install_workday_da_extension.py tests/scripts/test_flow_authorization.py -q (107 passed)
• git diff --check

Stacked on #307 and includes #306 as an explicit dependency. Once #306 merges, this branch can be rebased to remove those already-reviewed files from the diff.

[nkemms]

Review summary

• Adds the Workday DA orchestration and authorization tooling, but the authorization script cannot validate any acquired token and can report success after skipping requested workflows.
• Verdict: do not merge — 1 CRITICAL and 1 MAJOR finding.
• Minimum fixes: attach the candidate token during validation and fail unless every requested workflow exists and verifies as shared.

[nkemms]

Retraction — F-1 was based on redacted source rendering

I’m withdrawing my earlier token-validation finding. The review surface masked the bearer-header expression as ******, which I incorrectly interpreted as a literal static value. The underlying source already constructed the validation request from the supplied candidate token.

This was not a product defect. The added structural regression coverage is useful, but the original critical finding should not be considered an outstanding or previously confirmed issue. Apologies for the incorrect report.

[nkemms]

Updated review finding — checklist state is displayed against the wrong tasks

• Major — the rendered DA4 checklist does not match its canonical row order. src/skills/setup/workday-da/SKILL.md says the displayed checklist is verbatim from tasks.md, but it inserts “Share the Workday connection parameters” before “Bind the extension connections.” Canonical tasks.md defines DA4.3 as Bind, DA4.4 as Turn on flows, and DA4.5 as Connect/share. Positional status markers can therefore be shown beside the wrong user-facing task.

Render the displayed checklist from the canonical rows or make its titles and order exactly match tasks.md. This PR also remains dependent on the unresolved state-contract findings in #307.

[nkemms]

Re-reviewed the current head (ff13a82) against its stacked base. One incremental blocker remains:

• The rendered checklist does not match the canonical task rows — solutions/ess-maker-skills/src/skills/setup/workday-da/SKILL.md:107-145 says its headings and item titles are verbatim from tasks.md, but several are paraphrased and DA4 is reordered. In particular, canonical DA4.3/DA4.4/DA4.5 are bind connections, turn on flows, and connect Workday to the agent; the rendered checklist moves “Share the Workday connection parameters” ahead of binding/activation and omits the canonical DA4.5 title. That breaks the 1:1 mapping between user-visible progress and the Step IDs updated in durable state. Render the exact canonical titles in canonical order, or generate the display from tasks.md.

The repeated bearer-header concern from automated review is still a tooling redaction artifact, not a source defect. Retry, rollback, and compensating-delete concerns were also excluded. This PR additionally remains blocked on the unresolved state/evidence contracts in its PR 307 base.

[Surendra Goutham (is-goutham)]

Addressed the latest blocker in 469dba5: the rendered checklist now uses the exact canonical tasks.md titles and order, with a structural regression test comparing every visible row. Validation: 17 focused setup tests passed.

[nkemms]

Re-reviewed the latest head (469dba5). The rendered checklist now matches the canonical task titles and DA4 ordering.

I found no remaining critical issue in this PR's own changes. Good to merge into its stacked base. The overall stack remains held at PR 305.

[Surendra Goutham (is-goutham)]

Upstream PR #305 PAC-ring correction propagated cleanly through this branch. Final #309 stack validation after propagation: 943 tests passed; Enable-CosmosDAFlowAuthorization.ps1 parsed successfully.

The merge-base changed after approval.

[Surendra Goutham (is-goutham)]

GitHub stack rebase completed after #302 merged. This branch was rebased linearly onto the updated branch below it and force-pushed with lease. Final rebased #309 validation: 960 relevant tests passed; the 3 excluded router assertions reproduce unchanged on current main; PowerShell parser passed.