fix: sign OpenAPI requests with STS session token

[innsd]

Summary

• Include STS session tokens in ve_request signing via X-Security-Token.
• Propagate resolved session tokens through CR, CodePipeline, and identity OpenAPI clients.
• Add regression coverage for signer headers, CR/CP token propagation, identity decorators, and constructor compatibility.

Validation

• Real agentkit launch was verified successfully after the CR/CodePipeline token propagation fix.
• conda run -n agentkit_env_test python -m pytest -q tests/auth/test_identity_auth.py tests/utils/test_engineering_standards.py tests/toolkit/volcengine/test_provider_injection.py tests/toolkit/test_byteplus_single_region.py
• pre-commit hooks: ruff check, ruff format, hardcoded secret detection

[cuericlee]

/lgtm