Invalidate session affinity on auth-wide failures and force fresh upstream sessions

[clcc2019]

Motivation

• Ensure that when an auth becomes unavailable due to an auth-wide failure the session-affinity cache is invalidated so downstream sessions are not silently rebound to a failing credential.
• Force creation of a fresh upstream provider session when the same downstream session is rebound to a different auth to avoid reusing server-side sessions tied to the unavailable credential.

Description

• Add logic in Manager.MarkResult to detect auth-wide unavailability and trigger invalidateSessionAffinityForAuth, which calls InvalidateAuth on active affinity selectors.
• Extend SessionCache with a forceNew map and ConsumeForceNew method; InvalidateAuth now records recently unbound sessions into forceNew so callers can detect the need for a fresh upstream session.
• Update SessionAffinitySelector and manager affinity-based pick paths to consult ConsumeForceNew for primary and fallback session keys and call forceNewUpstreamSessionForNextCredential when necessary to start a fresh upstream session.
• Add TestManager_AuthWideFailureInvalidatesAffinityAndForcesFreshSession to validate that auth-wide failures clear affinity bindings and cause the next execution to force a new upstream session and rebind to a different auth.

Testing

• Ran the auth package unit tests: go test ./sdk/cliproxy/auth -run TestManager_AuthWideFailureInvalidatesAffinityAndForcesFreshSession and related affinity tests, and they passed.
• Existing selector and session-affinity tests in conductor_overrides_test.go were executed and continued to succeed after the changes.
• Verified the new SessionCache cleanup behavior via unit tests and ensured ConsumeForceNew entries expire correctly during cache cleanup.

---

Codex Task