test(iam): integration test for ReadRelationships and Health (S25 Step 7)

What

S25 Step 7 — integration test for the IAM relationships client, plus a self-signed CI rig that actually runs it against a real iam-data-access.

Adds internal/iam/client_integration_test.go (behind //go:build integration) with two tests that exercise the real iam.Client against a live iam-data-access instance:

• TestClient_IntegrationHealth — calls client.Health(ctx) and requires no error.
• TestClient_IntegrationReadRelationships — calls ReadRelationships with a subject/object pair from env vars. Per S25, an unresolved subject returns an empty []relationships.Relationship with no error; the test asserts no error and a non-nil slice, not a specific length.

The tests skip locally and in the shared test:integration job when ARTIFACT_REGISTRY_IAM_TEST_ADDRESS is unset, matching the pattern used by internal/brandlistvalidator/client_integration_test.go and internal/jobsriver/client_integration_test.go.

The self-signed CI rig

test:integration:iam-rig (new job) stands up a throwaway iam-data-access:v1.37.5 against a plain Postgres service and actually runs both tests above, instead of leaving them permanently skipped. iam-data-access has no real GitLab issuer to verify a caller's JWT against here, so the rig is self-signed end to end:

• iam-data-access's CONFIG_TOML env var (the image's own built-in content-injection path — services: containers can't receive this job's volume mounts) registers a throwaway issuer whose keys_url points at this repo's own raw-file URL for scripts/iam-rig-mint-jwt/testdata/jwks.json.
• scripts/iam-rig-mint-jwt mints a JWT with the matching private key committed alongside that JWKS document, satisfying the exact claim schema pkg/userauth/token.go requires (including a non-empty gitlab.local_id, which surfaced a real gap: the test wasn't populating Subject.LocalID at all until this rig actually exercised requireCallerIsSubject's match check).
• iam-data-access runs its own migrations on every boot (its entrypoint.sh), so no separate migrate step is needed.
• The signing key is a fixed, checked-in test-only fixture (see .gitleaks.toml for why it's not a real secret) — it authenticates nothing outside this one throwaway, per-job instance.

Took two real-CI iterations to go green: a missing platform.cors block (every service factory validates it on boot, even ones with no HTTP surface) and the missing local_id claim above.

Env vars

Variable	Required	Description
ARTIFACT_REGISTRY_IAM_TEST_ADDRESS	Yes (skips otherwise)	gRPC address, e.g. localhost:5005
ARTIFACT_REGISTRY_IAM_TEST_TOKEN	No	Service token (empty string is valid on rigs without enforcement)
ARTIFACT_REGISTRY_IAM_TEST_USER_TOKEN	No	End-user JWT ReadRelationships forwards on the caller's behalf; distinct from the service token above
ARTIFACT_REGISTRY_IAM_TEST_SUBJECT_TYPE	No (skips ReadRelationships)	Subject type string, e.g. organization
ARTIFACT_REGISTRY_IAM_TEST_SUBJECT_ID	No (skips ReadRelationships)	Subject origin ID
ARTIFACT_REGISTRY_IAM_TEST_SUBJECT_LOCAL_ID	No	Subject local ID; must match the JWT's gitlab.local_id claim on an enforcing rig
ARTIFACT_REGISTRY_IAM_TEST_OBJECT_ID	No (skips ReadRelationships)	Object ID

Spec coverage

#	Criterion	Test
AC-10	Integration: Health + ReadRelationships against a real iam-data-access	TestClient_IntegrationHealth, TestClient_IntegrationReadRelationships, run for real by test:integration:iam-rig
AC 1–9	All other criteria	Steps 1–6 (already merged or in review)

Commit stack

test(iam): integration test for ReadRelationships and Health
refactor: simplify IAM integration test per code-simplifier pass
fix(iam): skip instead of fatal when IAM address unset in CI
chore: document IAM integration test env vars in .env.example
fix(iam): fix stale ContextWithToken API and fail-closed subject-type parsing
test(iam): stand up a self-signed CI rig for the ReadRelationships/Health integration test
fix(ci): add platform.cors to the iam-rig CONFIG_TOML
fix(iam): carry LocalID through the ReadRelationships integration test
docs(iam): fix stale newTestClient comment

Related to #205 (moved)