test(smoke): skip recurring external-credential flakes instead of failing CI

[orhanrauf]

Summary

Three smoke tests have been failing on every PR (and on main) for days because their external dependencies are unavailable — not because of any product bug:

• test_oauth_token_injection_notion / test_oauth_token_defaults_sync_immediately_true in test_source_connections_oauth.py: the Notion authorization behind the Composio test account has been revoked, so POST /source-connections returns 400 Bad Request on the connect attempt.
• 8 tests in test_source_connections_token_injection.py: same revoked Notion token, same backend 400.
• test_composio_auth_provider_sync_immediately in test_source_connections_auth_provider.py: the Composio→Todoist account returns 401 "credentials invalid or revoked", so the sync job ends with error_category='auth_provider_credentials_invalid'.

What this PR does

• Both fresh_notion_token fixtures now probe api.notion.com/v1/users/me before yielding. If the token isn't actually live, dependent tests pytest.skip (mirroring the established pattern in test_cleanup.py:124). Missing config also becomes skip instead of fail.
• _wait_for_job_status (and the immediate-after-POST check) skips specifically when error_category == \"auth_provider_credentials_invalid\". Every other failure category still fails the test.

These changes only convert external-state flakes to skips; product regressions surfaced through the same code paths will still fail loudly.

Why these flakes weren't caught by the existing retry logic

The CI script retries failed tests up to 2 times, but only when fewer than 4 tests fail. Shard 0 hits exactly 10 failures (all from the revoked Notion token), so it never retries — and even if it did, the upstream creds wouldn't recover between attempts.

Test plan

• Changed-lines mypy gate: 100% on all three files (verified locally with `diff-quality --violations=mypy --fail-under=100`).
• Changed-lines ruff gate: 100% on all three files.
• Pre-commit hooks pass (ruff, import-linter, unit tests).
• Verify CI passes — the Public API Test job should go green on this PR (the previously-failing tests will report as "skipped" rather than "failed").

---

Summary by cubic

Skips recurring smoke test failures caused by revoked external credentials (Notion via Composio and Composio→Todoist). Keeps CI green on upstream outages while still failing on real product issues.

• Bug Fixes
  • Notion token fixtures probe /v1/users/me before yielding. Invalid token or missing config → pytest.skip.
  • Auth-provider sync skips when error_category="auth_provider_credentials_invalid" (both on initial read and during polling). Other categories still fail.
  • For CodeQL, keep token validation inside the try and pre-assign token/token_valid defaults so the analyzer sees them initialized; behavior unchanged.

^{Written for commit fa12a40. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}