ci: run the BDD suite against a real backend on pull requests

[socksy]

The integration suite only ever runs against the mock API server, so changes that break against a real Tower backend surface after merge, not before. This adds a workflow that runs the full BDD suite against a real backend at develop on every pull request.

The workflow assumes a role via OIDC (repo variables supply BACKEND_CI_ROLE_ARN and BACKEND_CI_AWS_REGION), wakes the build host, and asks it to build the PR's sha and run the suite. Runs queue behind a repo-wide concurrency group since they share one backend. Fork PRs skip the job — they can't mint OIDC tokens for this repo's environments; a maintainer pushes the branch into this repo to run it.

The deploy-idempotency feature gets a @mock-only tag: it asserts on the idempotency key the mock records, which a real backend doesn't echo back. The backend run excludes that tag.

Verified against the real backend at current develop: 49 scenarios passed, 0 failed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2bbeb54c-2b14-4b02-b8fd-61cf69a7d9e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}