flightcheck: exclude per-agent DA connection refs from WD-PKG-001 fingerprint

[Dawn Jeong (daeunJe0ng)]

What and why

Dependency: branches off the shared reader in #326 (merge first). Until #326 merges, this diff also shows its commit. Independent of the check re-point PRs (#304, #314, #315, #316, #317, #318).

WD-PKG-001 fingerprints the Workday install flavor (simplified 1-ref vs full/legacy 3-ref) from the connectionreferences bound to the shared_workdaysoap connector. Downstream Workday checks are gated on that flavor.

A Declarative Agent (DA) install adds a per-agent Workday connection reference whose logical name is {schema}.{guid}.shared_workdaysoap. It binds the same connector as the Microsoft-shipped solution refs, but it carries no _<5hex> role-suffix fingerprint. Before this change _check_package_flavor swept it into unknown_format_names, which forced every branch to fall through to branch 6 and classify a valid simplified/full install as unknown (WARNING).

Per the flavor-gating rule in tests/AGENTS.md (consumers skip only on a positive incompatible-flavor match; unknown/None default to RUN), an unknown verdict un-gates every downstream ISU/RaaS consumer check. So a healthy DA install would emit misleading FAILs. This is the AC6 gap on story AB#7865450.

Change

• _check_package_flavor (workday.py): skip refs whose logical name matches _AGENT_CONNECTION_REF_RE in the classification loop, collecting them into agent_scoped_refs. They no longer pollute unknown_format_names.
• Add an agent-scoped diagnostic line to the branch-6 unknown result so the degenerate all-agent-refs case (no solution ref at all) is not silently opaque.
• The cache runner._workday_connection_refs (WD-CONN-012 input) is left full on purpose. WD-CONN-012 only iterates the expected role suffixes, so the agent row is ignored there and needs no scope change.

Design notes

• Agent refs are excluded from the fingerprint only, not from the connector match. They remain visible to WD-CONN-012 (binding completeness), which is correct: an agent-scoped Workday connection still needs to be bound.
• The common real DA case (solution ref _ff0df + one agent ref) now classifies as simplified, as it should.

Tests

Added to TestPackageFlavorDetection:

• simplified solution ref + agent ref -> simplified (agent ref excluded, cache still 2 rows)
• full 3-ref install + agent ref -> full
• agent-ref-only (no solution ref) -> unknown WARNING with the agent-scoped diagnostic

New mock dv.workday_agent_scoped_connection_ref() (same connectionreferences GET shape, covered by the existing cassette per the tests/AGENTS.md same-endpoint rule).

Verification

• pytest tests/flightcheck/checks/test_workday_package.py -> 22 passed (3 new)
• pytest tests/flightcheck -> 1145 passed
• ruff check on all touched files -> clean

Not verified: live run against a deployed Workday-bound DA env (no reachable agent available; provisioning gap, not code).

Story: AB#7865450 (AC6). Checkpoint: WD-PKG-001.

[Dawn Jeong (daeunJe0ng)]

Closing as superseded by main.

The core fix this PR targeted (AB#7852495 - per-agent Declarative Agent connection references must not misclassify the WD-PKG-001 install fingerprint as "unknown") has already landed on main via "Honor agent scoping in Workday checks" and "Harden FlightCheck provider and agent scope". Those commits exclude agent-scoped refs at the workday_refs comprehension in _check_package_flavor, so a valid Declarative Agent install no longer misclassifies.

The only remaining deltas in this PR over main were secondary design choices (keeping agent refs in the WD-CONN-012 cache, and reporting an agent-refs-only tenant as unknown/Warning with a diagnostic rather than none/NotConfigured). Not worth carrying a competing implementation of the same work item. Closing.