Fix FlightCheck Entra SSO app selection

[apurvabanka]

Summary

Lets standalone FlightCheck target a specific Entra SSO app / connection, plus
a related WD-PKG-001 prompt fix.

Changes

• Entra SSO app / connection selection: standalone-scope FlightCheck now lets
  the operator choose which Entra SSO app / connector connection to validate via
  --select-targets (auto | always | never), instead of validating all.
• Stored SSO app confirmation: when a Workday SSO app is already persisted,
  the run confirms/reminds the operator before reusing it.
• Connection pin: check_connector_connections can narrow to the selected
  connection (e.g. dev/test/prod) so tenants with multiple connections for the
  same connector report on just the one being verified.
• Installer: FlightCheck invocation now passes --select-targets always
  (Install-EssAdk.ps1, install-ess-adk.sh).
• WD-PKG-001 prompt fix: --checkpoint WD-PKG-001 no longer blocks on the
  "Test Employee ID" / ISU credential prompts. Interactive Workday runtime prompts
  are now gated to runs that actually consume them (WD-WF* and full/scope runs).
• Tests: added coverage for target selection, Entra app resolution, stored-app
  confirmation, and WD-PKG-001 prompt gating.

[apurvabanka]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merged main into this branch and resolved the conflict in SKILL.md (commit 9929e6f). The conflict was in the Step 2b run instructions — I combined both the --select-targets never {TARGET_FLAGS} additions from this PR and the --runtime-reachability consent-gate instructions from main.

[nkemms]

Reviewed the full diff and ran the tests — LGTM.

Clean, defensive change: every narrowing path (connection pin, SAML app scope, target selection) fails open, so a stale/typo'd pin never masks a real problem. Traced the WD-PKG-001 prompt-gating fix — scope="checkpoint:<target>" parses correctly, so WD-PKG-001 no longer prompts while WD-WF* still does. Selection runs after auth, before checks.

PR's 4 new test files: 100 pass. (The 8 test_workday_personal_data.py failures reproduce identically on main — pre-existing Python 3.14-vs-3.12 env drift, not this PR.)

Two optional NITs, non-blocking: _prompt_choice returns "All" if a chosen candidate has an empty appId/name (unreachable, fails open); the always docstring vs the single-candidate picker-skip is a minor wording nuance.

[nehaoss]

This new _workday_hints-based narrowing isn't actually gated to scope-mode runs the way the comment above claims ("single-checkpoint mode never sets one" / "No pin ⇒ unchanged all-apps behavior"). _workday_hints falls back to .local/connect/workday/config.json on disk, and --checkpoint WD-CONN-102 sets runner.config too (_run_single_checkpoint), so a targeted --checkpoint WD-CONN-102 run will silently narrow to the persisted entraAppId whenever one exists — which is the normal post-setup case. That's a behavior change for checkpoint mode: if the persisted app is stale/wrong, WD-CONN-102 now scopes away the actually-broken app and can report green. Please either gate the narrowing to the scope-mode selection (so --checkpoint keeps the old all-apps behavior), or drop the "single-checkpoint mode never sets one" claim and document that checkpoint runs narrow via the persisted hint.

[Copilot]

Pull request overview

This PR enhances FlightCheck’s standalone --scope workflow by adding interactive/flag-based target selection for Workday Entra SSO apps and ServiceNow connections, and fixes Workday interactive prompt behavior so --checkpoint WD-PKG-001 no longer blocks on runtime-input prompts that won’t be reported.

Changes:

• Add CLI support for listing/selecting targets (--list-targets, --workday-app-id, --servicenow-connection, --select-targets) and plumb the selection into the runner.
• Scope Workday SAML cert health (WD-CONN-102) and ServiceNow connection checks (SN-CONN-*) to the selected target where applicable.
• Add/update docs, installer invocations, and tests covering target selection + Workday prompt gating.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/flightcheck/test_cli_target_selection.py	New unit tests for CLI target-selection helpers and selection precedence.
tests/flightcheck/checks/test_workday_prompt_gating.py	New tests ensuring WD-PKG-001 checkpoint runs don’t trigger interactive Workday prompts.
tests/flightcheck/checks/test_target_selection.py	New check-level tests for Workday SSO-app scoping and ServiceNow connection-pin scoping.
tests/flightcheck/checks/test_entra_app.py	Isolates tests from local connect config to keep Entra-app tests deterministic.
solutions/ess-maker-skills/src/skills/flightcheck/SKILL.md	Documents ADK-driven target selection via --list-targets and passing resolved flags into the run.
solutions/ess-maker-skills/scripts/flightcheck/runner.py	Adds servicenow_connection_pin to runner for downstream scoping.
solutions/ess-maker-skills/scripts/flightcheck/cli.py	Implements target discovery, interactive prompting, and runner pinning for scope runs.
solutions/ess-maker-skills/scripts/flightcheck/checks/workday.py	Scopes WD-CONN-102 by the resolved Workday app hint; gates interactive prompts in checkpoint mode.
solutions/ess-maker-skills/scripts/flightcheck/checks/servicenow.py	Passes the runner’s ServiceNow pin into generic connection checking.
solutions/ess-maker-skills/scripts/flightcheck/checks/connections.py	Adds optional connection_pin to narrow connector connection results when it matches.
solutions/ess-maker-skills/.github/copilot-instructions.md	Adds guidance to render FlightCheck results directly from results.json without helper scripts.
setup/Install-EssAdk.ps1	Runs FlightCheck with --select-targets always during installer flow.
setup/install-ess-adk.sh	Runs FlightCheck with --select-targets always during installer flow.