test(e2e): move Keycloak provider refresh coverage out of rootless Podman lane

[elezar]

Description

Re-add the provider_refresh_keycloak e2e coverage outside the rootless Podman replacement path. The old direct-runner rootless Podman matrix included e2e:provider-refresh-keycloak, but the test validates provider OAuth2 refresh-token recovery behavior rather than rootless Podman behavior.

Context

PR #2981 removed the direct-runner rootless Podman job, which also removed CI execution of e2e:provider-refresh-keycloak because that task was part of the old rootless Podman matrix.

PR #2982 replaces the old direct-runner rootless Podman lane with a Nix VM-backed rootless Podman smoke lane. During comparison with the pre-#2981 pipeline, we identified that provider_refresh_keycloak was previously run in the rootless Podman matrix even though it is driver-independent in intent.

The test verifies that a valid Keycloak refresh token can rotate provider credentials, that a revoked refresh token fails with invalid_grant, and that provider refresh status reports reauthorization is required without rendering the parked scheduling sentinel as a date.

Definition of Done

• provider_refresh_keycloak runs from a driver-independent conformance or provider-refresh e2e location.
• The coverage no longer depends specifically on the rootless Podman lane.
• CI invokes the test against an appropriate supported gateway backend.
• Documentation or task names make the test's provider-refresh purpose clear.