flightcheck: add WD-ENV-101 Workday ISU username vs Entra UPN format alignment

[GrahamMcMynn]

Implements the FlightCheck check requested in #82.

Checkpoint: WD-ENV-101
Category: Workday
Priority: HIGH
Conditional? No (runs whenever Workday flows are detected)

API tier:

• Dataverse: documented (existing tests/mocks/dataverse.py, MS Learn environmentvariabledefinition / environmentvariablevalue reference)
• Microsoft Graph v1.0: validatable (existing tests/mocks/graph.py, CSDL EntityType Name="organization" + https://learn.microsoft.com/graph/api/organization-get)

Mock source: Reuses existing builders only — no new mock module, no registry update.

What this check does

Pulls EmployeeContextRequestAccountName from Dataverse and compares its shape against the tenant's verified Entra domains read from Microsoft Graph (runner.graph.get_organization() → verifiedDomains[].name). Federated tenants (Okta, Ping, ADFS) frequently leave the ISU username in a legacy short-employee-id format that doesn't match the UPN claim ESS sends on each request, which prevents Workday from matching the incoming request to a Worker — a common misconfiguration on tenants that provisioned the ISU before adopting UPN-shaped service-account naming.

Heuristics:

• No @ in the ISU username → Warning (legacy short-id format — the most-cited misconfiguration root cause).
• @ present but the domain part isn't in the tenant's verified domains → Warning (could be legitimate cross-tenant federation; surface for the operator to confirm).
• <localpart>@<verified-domain> → Passed.

Tests

tests/flightcheck/checks/test_workday_isu_username_format.py covers GOOD (UPN-shaped + verified-domain match, plus the initial *.onmicrosoft.com domain), BAD (no-@ legacy short-ID scenario, unverified-domain), defensive (empty verifiedDomains, empty org record, Graph raises), and SKIPPED paths (no Dataverse token, no Graph client, ISU env var unset — defers to WD-ENV-001).

11 new tests pass; the existing 18 flightcheck tests still pass unchanged. Full repo suite: 113 passed, 8 skipped.

Verification context

The source issue did not include a ## Verification section, so the implementation pattern was inferred from the most-similar existing check: _check_env_vars in the same module (checks/workday.py) for the Dataverse half, and checks/prerequisites.py for the runner.graph usage pattern. Test file mirrors tests/flightcheck/checks/test_workday_env_vars.py.

End-to-end validated against a real tenant: ran flightcheck against a Workday-equipped environment with the Dataverse env var both UPN-shaped (PASSED) and deliberately set to a legacy short-id value (WARNED with the expected remediation).

What was deferred (and why)

The deeper Get_Workers User_ID == Entra UPN per-Worker comparison from the suggested implementation is intentionally deferred to a follow-up:

1. The Workday SOAP mock module (tests/mocks/workday.py) is MOCK_STATUS = "placeholder" and would need promotion to validated against flightcheck_workday.yaml before any test could exercise that surface (per the conftest enforcement).
2. "A sample of expected ESS users" requires a curated mapping from Workday Employee_IDs to Entra UPNs that no current FlightCheck config supplies (the existing _check_workflows only exercises a single WORKDAY_TEST_EMPLOYEE_ID).
3. The static format check landed here already addresses the legacy-ISU root cause (short-employee-id ISU format on a federated tenant) — a future WD-WF-NNN can wire the per-Worker comparison once the Workday mock is promoted and the sample-list input is formalised.

Additional fixes piggy-backed on this PR

While validating WD-ENV-101 end-to-end against a real tenant, three latent bugs in the original May 7 Python-scripts commit surfaced — each one blocked the new check (or other checks) from running on most tenants. They are fixed in this PR because the new WD-ENV-101 check could not be validated without them.

1. PP Admin env id derivation (pp_admin_client.py + cli.py) — derive_environment_id() returned the Dataverse OrgId rather than the BAP env id (different GUIDs on most tenants), so every BAP-scoped check (ENV-001/002/003, EXT-001, flow listing, connection enumeration) 404'd. Now uses an instance-URL match against the BAP env list, mirroring pva_client._discover_gateway().
2. Flow listing endpoint (pp_admin_client.py) — get_flows() was hitting api.powerapps.com/.../v2/flows (404, path doesn't exist there) instead of api.flow.microsoft.com/.../v2/flows with the required service.flow.microsoft.com//.default audience token. Adds FLOW_BASE, FLOW_SCOPE, dual-token authenticate(), and use_flow_token=True plumbing.
3. License SKU matching (checks/prerequisites.py) — PRE-001/002/003 used case-sensitive in checks against UPPER_CASE patterns while Graph returns mixed-case values (Microsoft_365_Copilot); also missed Teams bundles (O365_BUSINESS_PREMIUM, ENTERPRISEPACK, etc.). Added _sku_matches() helper + reference-list-grounded SKU tuples.

Test-side follow-up (tests/mocks/pp_admin.py, tests/flightcheck/test_pp_admin_client.py, tests/fixtures/cassettes/INDEX.md): aligned with the corrected Power Automate endpoint. The previous "bug 4" regression test pinning a 404 from api.powerapps.com as "expected for Dataverse-only environments" was a misdiagnosis — the 404 was a wrong-URL artefact — and has been removed.

A companion PR (#95) documents the corresponding guidance updates to flightcheck/AGENTS.md so future agents don't reintroduce the same classes of bug.

Fixes #82

[GrahamMcMynn]

Code review by ESS Code Review Agent