test(tmachine): migrate Keycloak provider refresh coverage

[elezar]

Summary

Migrate Keycloak provider-refresh end-to-end coverage into a reusable tmachine suite and run it through artifact-reusing tmachine CI.

Related Issue

No issue required: internal test-infrastructure migration and CI refactor.

Changes

• Move the Rust provider-refresh Keycloak test into tests/suites/features and package it as a nextest archive.
• Add reusable nextest-archive and Keycloak fixture roles, and centralize tmachine client setup.
• Include the current PR 3382 artifact-reuse implementation as one commit, rename the reusable workflow to Tmachine Tests, and make the scenario/suite matrix selectable.
• Replace default Keycloak Podman E2E callers with the Fedora Podman-rootful tmachine suite while retaining existing job names.

Testing

• mise run pre-commit passes
• E2E tests added/updated
  • nix run .#build-artifacts-test-archives
  • nix run .#tmachine -- test ubuntu-docker-rootful smoke
  • nix run .#tmachine -- test ubuntu-docker-rootful provider-refresh-keycloak
  • nix run .#build-artifacts-binaries && nix run .#tmachine -- test fedora-podman-rootful provider-refresh-keycloak

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3404.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for d016800. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.