flightcheck: add canonical DA connection-reference reader + contract test

[Dawn Jeong (daeunJe0ng)]

Summary

Adds the single canonical Declarative Agent (DA) connection-reference reader that the six FlightCheck re-point PRs (#304, #314, #315, #316, #317, #318) all depend on, so they stop each shipping a divergent private copy of it.

Today the re-point PRs would otherwise each carry a private copy of the connection-reference reader:

• flightcheck: re-point ENV-004 to Declarative Agent components API #314 and flightcheck: re-point WD-REST-001 + WD-ENV-001 to Declarative Agent components API #317 originally each added a different checks/_da_connection_refs.py (107 vs 196 lines).
• flightcheck: re-point ENV-004 to Declarative Agent components API #314 also removed the legacy checks/_agent_connection_refs.py.
• All six edit checks/workday_extension.py and flightcheck/registry.py.

That would make the six PRs impossible to merge in any order without an add/add + edit conflict cascade. This PR lands the shared reader once; the six re-point PRs are now rebased on it and import the canonical one.

What this adds

• checks/_da_connection_refs.py (canonical union reader): superset of the reader from flightcheck: re-point WD-REST-001 + WD-ENV-001 to Declarative Agent components API #317, with:
  • json.loads handling for sharedConnectionParameters when the AgentBuilder / minimalBots components API returns it as a JSON string (observed live) rather than a nested object.
  • a new public read_all_agents_connection_references(runner) that reads every agent's connection references and de-dupes by connection-reference logical name (casefold, first-wins) for the environment-wide ENV-004 check.
• The three consumers this reader serves: DV-CONN-001 (active agent refs), ENV-004 (environment-wide, de-duped), and the Workday shared-parameter checks WD-ENV-001 / WD-REST-001.
• tests/mocks/agentbuilder_connectivity.py: superset mock builders (validated) needed by the checks and the contract test.
• tests/flightcheck/checks/test_da_connection_refs.py: 18 pure-logic contract tests covering normalization, None-gating (SKIP), fail-loudly ValueError, JSON-string sharedConnectionParameters parsing, and the Workday shared-parameter sweep.

Design rationale

• One shared reader instead of per-check copies removes the merge collision and keeps a single source of truth for the components-API connection-reference shape.
• The reader is pure logic over the components payload, so it is unit-testable without network; the contract test pins the exact shapes the six re-point PRs rely on.
• Mock builders trace to the validated agentbuilder_connectivity mock (MOCK_STATUS = validated), per the test-authoring rule that checks calling external APIs need a validated/documented mock.

Testing

• python -m pytest tests/flightcheck/checks/test_da_connection_refs.py -q -> 18 passed.
• python -m pytest tests/flightcheck -q -> 1142 passed.

Risk / notes

• Additive: new reader + new test + superset mock. No existing check is re-pointed in this PR.
• The six re-point PRs (flightcheck: fail loud on malformed DA connection-ref payloads (reader hardening) #304, flightcheck: re-point ENV-004 to Declarative Agent components API #314, flightcheck: re-point PUB-001 + PUB-002 to Declarative Agent ALM export/import API #315, flightcheck: re-point ESS-SOLN-001 to Declarative Agent GRS/ALM configure API #316, flightcheck: re-point WD-REST-001 + WD-ENV-001 to Declarative Agent components API #317, flightcheck: re-point WD-WF-CAT-001 + WD-REF-001 to Declarative Agent components API #318) are already rebased on this branch and inherit the canonical reader; none of them re-add or modify _da_connection_refs.py (verified). flightcheck: add Workday DA profile + versioned result contract #327 and flightcheck: exclude per-agent DA connection refs from WD-PKG-001 fingerprint #328 also branch off this PR.

Foundation for AB#7865455 (DA profile + structured-result contract) under story AB#7865450.

[amilandi]

LGTM. Canonical reader factored cleanly out of the six re-point PRs; JSON-string sharedConnectionParameters handling, casefold-first-wins ENV-004 de-dupe, and the None-gate -> SKIP / malformed -> ValueError contract all check out. 18 contract tests pin the shapes the downstream PRs consume.