Fix FlightCheck Entra SSO app selection

[apurvabanka]

Summary

Lets standalone FlightCheck target a specific Entra SSO app / connection, plus
a related WD-PKG-001 prompt fix.

Changes

• Entra SSO app / connection selection: standalone-scope FlightCheck now lets
  the operator choose which Entra SSO app / connector connection to validate via
  --select-targets (auto | always | never), instead of validating all.
• Stored SSO app confirmation: when a Workday SSO app is already persisted,
  the run confirms/reminds the operator before reusing it.
• Connection pin: check_connector_connections can narrow to the selected
  connection (e.g. dev/test/prod) so tenants with multiple connections for the
  same connector report on just the one being verified.
• Installer: FlightCheck invocation now passes --select-targets always
  (Install-EssAdk.ps1, install-ess-adk.sh).
• WD-PKG-001 prompt fix: --checkpoint WD-PKG-001 no longer blocks on the
  "Test Employee ID" / ISU credential prompts. Interactive Workday runtime prompts
  are now gated to runs that actually consume them (WD-WF* and full/scope runs).
• Tests: added coverage for target selection, Entra app resolution, stored-app
  confirmation, and WD-PKG-001 prompt gating.

[apurvabanka]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merged main into this branch and resolved the conflict in SKILL.md (commit 9929e6f). The conflict was in the Step 2b run instructions — I combined both the --select-targets never {TARGET_FLAGS} additions from this PR and the --runtime-reachability consent-gate instructions from main.

[nkemms]

Reviewed the full diff and ran the tests — LGTM.

Clean, defensive change: every narrowing path (connection pin, SAML app scope, target selection) fails open, so a stale/typo'd pin never masks a real problem. Traced the WD-PKG-001 prompt-gating fix — scope="checkpoint:<target>" parses correctly, so WD-PKG-001 no longer prompts while WD-WF* still does. Selection runs after auth, before checks.

PR's 4 new test files: 100 pass. (The 8 test_workday_personal_data.py failures reproduce identically on main — pre-existing Python 3.14-vs-3.12 env drift, not this PR.)

Two optional NITs, non-blocking: _prompt_choice returns "All" if a chosen candidate has an empty appId/name (unreachable, fails open); the always docstring vs the single-candidate picker-skip is a minor wording nuance.