Fix Secrets Manager entitlement gate failing open on CDot timeout

What does this MR do and why?

The job-scheduling gate in RegisterJobService checks Secrets Manager entitlement with a tight timeout so runner polling stays fast. When CustomersDot answers slower than that budget, the gate fails open and the build is assigned to the runner anyway.

The runner payload step then re-checks the same entitlement, finds the real denial, and used to just drop the login details from the payload. The runner had no way to know why and failed with "inline auth JWT is required", surfaced to the user as a runner system failure with a useless retry hint.

Three changes, matching the plan agreed on work item 628997:

• Correct failure reason. The payload step now raises when entitlement denies access, and RegisterJobService catches it to drop the build with secrets_manager_access_denied, the same reason the gate already uses. The user now sees the correct message regardless of which layer catches the denial.
• Cache warming. A successful resolution at the payload step now warms the same one-minute cache the gate reads, so a lost race is repaired for the rest of that window instead of every job pickup re-asking CustomersDot cold. A resolution failure is never what gets cached, only a genuine answer is, so one transient error can't turn into a minute of wrongly denied jobs.
• Wider timeout. The gate's per-call timeout goes from 0.25s to 1.0s, covering a normal cold resolve plus jitter instead of racing a budget with almost no headroom on self-managed.

Design decisions

• The fail-closed safety net for entitlement resolution is unchanged. A resolution error still denies access, it just now reports the accurate reason instead of a generic runner failure.
• No new feature flag. This changes existing gate and payload logic directly, gated by the same secrets_manager_paid_experience flag already in place.

Backward compatibility and rollback

• No database migrations, no schema changes.
• EE-only code path (ee/), touches one shared CE hook method with a no-op default, so CE/FOSS behavior is unaffected.
• Safe to revert as a plain code revert. No data or state is introduced that would need cleanup.

Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/628997 Related to !254034 (merged) Related to !254445 (merged)

Changelog: fixed

References

Screenshots or screen recordings

Not applicable. Backend-only change, no UI impact.

How to set up and validate locally

Run the touched specs:

bundle exec rspec \
  spec/services/ci/register_job_service_spec.rb \
  ee/spec/services/ci/register_job_service_spec.rb \
  ee/spec/presenters/ci/build_runner_presenter_spec.rb \
  ee/spec/lib/secrets_management/entitlement_spec.rb \
  ee/spec/lib/secrets_management/entitlement/resolver_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.