fix(auth): reuse a process-wide wasmtime engine

[anastasia-nesterenko]

Summary

Auth-enabled test clients previously created a new wasmtime Engine for every OPAPolicy, repeatedly initializing native JIT and trap-handling resources until an xdist worker could terminate without a Python traceback. This change creates one lazy, thread-safe Engine per process and reuses it while each policy instance retains its own Store and evaluation state.

Changes

• Add a thread-safe, lazily initialized process-wide wasmtime Engine.
• Reuse the engine while each OPAPolicy continues to create its own Store, linker, module, and instance.
• Remove the scoped-access-key xdist_group pin so the test runs through normal integration-test scheduling.
• Retain integration coverage for valid and tampered access-key authentication.
• Verify that revocation is listed as REVOKED and that the revoked token fails authentication and workspace access.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with documentation updates
• Documentation only
• Contributor tooling or automation
• CI, build, or test infrastructure

Quality Gates

• Tests added or updated for changed behavior
• Documentation updated for user-visible behavior
• Documentation not applicable — justification: this changes internal policy-engine resource management without changing user-visible or API behavior.

Verification

• Pull request title follows the repository's Conventional Commit format
• Every commit includes an appropriate Signed-off-by: trailer
• uv run pre-commit run -a passes, or any blocked checks are identified below
• Targeted tests pass, or tests are marked not applicable above
• No secrets, API keys, or credentials are included

Targeted validation:

• uv run --frozen pytest -q services/core/auth/tests/integration/test_scoped_access_keys.py services/core/auth/tests/test_embedded_pdp.py services/core/auth/tests/test_embedded_pdp_stress.py -m "not slow" — 80 passed, 4 deselected.
• uv run --frozen ruff check services/core/auth/src/nmp/core/auth/app/embedded_pdp/engine.py services/core/auth/tests/integration/test_scoped_access_keys.py — passed.
• uv run --frozen ruff format --check services/core/auth/src/nmp/core/auth/app/embedded_pdp/engine.py services/core/auth/tests/integration/test_scoped_access_keys.py — passed.
• uv run --frozen ty check services/core/auth/src/nmp/core/auth/app/embedded_pdp/engine.py services/core/auth/tests/integration/test_scoped_access_keys.py — passed.
• uv run --frozen pytest -q services/core/auth/tests/integration/test_scoped_access_keys.py — 1 passed; covers REVOKED status and rejection of the revoked token by auth and workspace endpoints.
• uv run --frozen pre-commit run -a — relevant Ruff, formatting, type-checking, config, and repository checks passed; the full gate was blocked because helm-docs is not installed and the host uv version is 0.9.18 instead of the required 0.9.14.
• GitHub Actions run 31754381754 — CI evidence for this change.