Scope managed secrets to selected teams

[warp-agent-staging]

Description

Scope managed-secret requests to the selected team across the Oz CLI, GUI, TUI, and harness-auth flows. This adds an app-owned scoped facade, makes oz secret list accept the shared TeamSelection, and isolates cached harness secrets by request scope and harness.

Long-lived views now resolve their current window scope at operation time, cache invalidation rejects stale in-flight fetch completions, and persisted auth-secret defaults are keyed by scope and harness. Legacy harness-only defaults remain available only to personal/teamless requests.

Owner resolution remains independent from request scope, and task/workload-token operations remain resource-authoritative.

Linked Issue

• REV-2383
• Slack origin
• The tracked Linear issue is in progress and carries the factory label.
• Automated verification is included below; visual verification was explicitly declined for this vertical.

Testing

• ./script/format
• ./script/check_no_inline_test_modules
• cargo test -p warp_cli 'secret::tests::list_accepts_' -- --nocapture
• cargo test -p warp --features tui auth_secret_cache_key_distinguishes -- --nocapture
• cargo test -p warp --features tui request_team_scope_sets_only_the_resolved_team_header -- --nocapture
• cargo test -p warp scoped_auth_secret_defaults_do_not_cross_team_scope
• cargo test -p warp invalidation_rejects_in_flight_auth_secret_fetch_generation
• cargo test -p warp long_lived_view_resolvers_follow_only_their_own_window_team_switch
• cargo check -p warp -p warp_cli -p warp_tui
• cargo clippy -p warp --lib -- -D warnings
• cargo clippy -p warp_cli --all-targets --all-features -- -D warnings
• cargo clippy -p warp_tui --lib --bins -- -D warnings

cargo test -p warp_tui orchestration_block and TUI all-target test linting are blocked on the base branch by three existing warpui delegate implementations missing get_cursor_shape. ./script/presubmit passed formatting and inline-test checks, then exhausted the sandbox disk during workspace-wide Clippy; the affected targets were compiled and linted separately above.

• I have manually tested my changes locally with ./script/run

Agent Mode

• Warp Agent Mode - This PR was created via Warp's AI Agent Mode

CHANGELOG-IMPROVEMENT: Scope managed secrets and harness credentials to the selected team.

[warp-agent-staging]

This PR was generated with Warp.

Comment @warp-factory on this PR to send it follow-up work.