[FEATURE] oci_signing_v1: honor doc-level env var indirections in the provider-doc default auth context #710

Context

any-sdk (branch fix/empty-query-request-target, commit 8f975b9) added doc-level OCI env var
indirections to the provider-doc auth DTO, so a provider document can ship default env var names
in its config.auth block:

config:
  auth:
    type: oci_signing_v1
    tenancy_ocid_envvar: OCI_TENANCY
    user_ocid_envvar: OCI_USER
    oci_fingerprint_envvar: OCI_FINGERPRINT
    oci_private_key_path_envvar: OCI_KEY_FILE
    oci_passphrase_envvar: OCI_PASSPHRASE

The fields are plumbed through internal/anysdk/auth_dto.go, pkg/authsurface.AuthDTO and the
public/formulation wrapper. Getters: GetOciTenancyOCIDEnvVar, GetOciUserOCIDEnvVar,
GetOciFingerprintEnvVar, GetOciPrivateKeyEnvVar, GetOciPrivateKeyPathEnvVar,
GetOciPassphraseEnvVar, GetOciRegionEnvVar. Indirections only - literal credential values
remain runtime-auth-context territory by design.

The oci provider already ships these defaults in its provider.yaml, so a populated OCI_*
environment should need no --auth argument at all - matching the zero-config behaviour of the
credentialsenvvar API-key providers.

The last mile (this issue)

transformOpenapiStackqlAuthToLocal (internal/stackql/handler/handler.go:675) builds the
provider-default AuthCtx from the doc-level DTO but only copies the generic fields, so the OCI
keys above are silently dropped today. Add the mapping onto the runtime dto.AuthCtx fields:

No other change is needed: updateAuthContextIfNotExists (same file) already gives the desired
semantics - a populated OCI_* environment works with no --auth argument, an explicit --auth
context wins unconditionally, and with neither raw values nor env vars the existing
~/.oci/config fallback is unchanged. Env var resolution happens at request time in any-sdk
auth_util, so there is no doc-load-time coupling.

Acceptance

• Add the env var defaults to test/registry/src/stackql_oci_testing/v0.1.0/provider.yaml,
  pointed at the namespaced test names (STACKQL_OCI_TESTING_*), and a stackql_oci_auth.robot
  case that runs the signed GET with those env vars set and no --auth, asserting the composed
  keyId <tenancy>/<user>/<fingerprint>.
• Precedence: the same query with an explicit --auth context carrying different env var names
  uses the explicit context (existing behaviour, now asserted).
• Negative: no env vars, no --auth, no config file -> the existing config-file-miss error
  surface (no regression).

Dependency

Requires the go.mod bump to the any-sdk release cut from fix/empty-query-request-target,
which also carries the empty-query (request-target) fix (dangling ? broke every no-query
signed body verb against live OCI - all OCI write operations depend on it).