ci: run the BDD suite against a real backend on pull requests

[socksy]

Use an OIDC role to run the CLI tests from a PR on our branchbuild server. Previously we ran these tests on our backend repo, and in this CLI vs the mock, but when the mock diverges from the backend we can accidentally release regressions we won't see until publishing a version (backend CI tests are using the latest pypi version).

The integration suite only ever runs against the mock API server, so changes that break against a real Tower backend surface after merge, not before. This adds a workflow that runs the full BDD suite against a real backend at develop on every pull request.

Additionally add a @mock-only tag to be able to skip tests that don't work against a live instance (e.g. because of assumed data/deliberate timing in responses etc).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2bbeb54c-2b14-4b02-b8fd-61cf69a7d9e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}