Create OAuth service account for workflow-bundles test harness

[man4ish]

Problem

The workflow-bundles test harness (scripts/test_workflows.py) now requires
IAM authentication after PR #16, but no service account exists for it yet.
This is blocking the final validation run.

Current Workflow Status (last run: 2026-08-06)

Status	Count	%	Notes
✅ PASS	601	97.7%	Confirmed passing
❌ FAIL	4	0.6%	WDL/Cromwell only
⏱ TIMEOUT	3	0.5%	Expected → PASS after PR #18 Groovy fix
🟡 DATA	2	0.3%	rnaseq_cwl_v1 backend bug + 1 other
Total	610		5 disabled bundles excluded

Expected after this issue is resolved: ~604+ PASS (98.4%+)

PRs already merged (workflow-bundles)

• nginx: tool-images API (/v1/tools, /v1/build) not routed #7 Run button → Docker runner
• nginx: model-registry API (/modelregistry/v1) not routed #8 DSL2 fixes
• nginx: dev-hub's /rag and /status calls are unroutable — confirmed live in devhub-ui source #9 Bundle path resolution (616/616)
• control-center: remove dead cc-ui (React frontend) code #10 67 registry path mismatches
• web-ui: Jobs.jsx hits an absolute http://<host>:8081/ URL in production instead of a relative/proxied path #11 544 AWS Batch def declarations
• dev-hub: /rag/query 500s on Ollama /api/embeddings failure — blocking for v0.7.0 RAG-completion-with-GPU work #12 328 stub/script ordering
• tool-images: build_all.sh missing from the image — /v1/build/{tool} fails with exit 127 #13 rnaseq_cwl_v1 test fixtures
• model-registry: frontend never sends Authorization header — register/promote/hf-push are completely non-functional #14 6 DATA bundle fixtures
• web-ui: rolesApi.js's ./session import misses the web-mode session alias — Roles admin console fails CORS #16 IAM auth on Workflow Registry API
• Phase 1 PR4: cut Electron client onto unified auth-service #18 544 Groovy import declarations
• Integrate license_server.py backend with omnibioai-auth IAM #19 616 comprehensive READMEs

Action needed (requires admin access)

Create an OAuth client for the test harness:

curl -s -X POST http://localhost:8001/orgs/{org_id}/oauth-clients   -H 'Authorization: Bearer <admin-token>'   -H 'Content-Type: application/json'   -d '{
    "name": "workflow-test-harness",
    "description": "CI test harness for workflow bundle validation",
    "grant_types": ["client_credentials"]
  }' | python3 -m json.tool

Then provide CLIENT_ID + CLIENT_SECRET

# Run the full 610-workflow validation suite
CLIENT_ID=<id> CLIENT_SECRET=<secret>   python3 scripts/test_workflows.py 2>&1 |   tee reports/test_run_$(date +%Y%m%d_%H%M).txt

Acceptance criteria

• OAuth client created for workflow-test-harness
• CLIENT_ID + CLIENT_SECRET provided to workflow team
• Full test suite runs clean: target 604+ PASS
• Results tagged as v0.4.0 in omnibioai-workflow-bundles

References

• workflow-bundles test harness: scripts/test_workflows.py (main branch)
• Last full report: reports/test_run_20260806_*.txt
• Repo: https://github.com/OmniBioAI/omnibioai-workflow-bundles