fix(credentials): keep keyless refusals intact through AWS and Databricks verification

- AWS and Databricks verification and trust-probe catches rethrow a
  KeylessCredentialRefusedError unchanged instead of wrapping it, so a
  keyless reconnect or create that loses signing mid-save still reports
  WORKLOAD_IDENTITY_NOT_CONFIGURED.
- Google's keyless catalog description and hint say keyless works only
  for Google Cloud services (BigQuery, Vertex AI), not Google Workspace;
  the docs page says the same.
- OpenAPI examples use conspicuous subject and subjectProof placeholders.
- Record the keyless subjects route in the Copilot refused-routes
  inventory, drop a stray create-body field from a use-case test, and
  update the docs compatibility baseline for the regenerated CLI pages.

Author: waleedlatif1

apps/docs/content/docs/integrations/google-service-account.mdx

@@ -233,7 +233,7 @@ Self-hosted deployments need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an `https`
 
 ### From the API or CLI [#keyless-api-cli]
 
-Run `sim credentials keyless-subject google-service-account`, trust the printed subject as above, then add `projectNumber`, `poolId`, `providerId`, and `serviceAccountEmail` to its `keylessConfig` and pass it to `sim credentials create google-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it.
+Run `sim credentials keyless-subject google-service-account`, trust the printed subject as above, then add `projectNumber`, `poolId`, `providerId`, and `serviceAccountEmail` to its `keylessConfig` and pass it to `sim credentials create google-service-account`. See [the CLI credentials reference](/cli/credentials) for the full two-step example; the proof expires after 24 hours and works only for the user who requested it. As in the dialog, keyless works only for Google Cloud services such as BigQuery and Vertex AI, not Google Workspace blocks.
 
 ### Troubleshooting keyless access
 

apps/docs/openapi-v2-resources.json

@@ -3862,7 +3862,7 @@
                     "type": "service_account",
                     "providerId": "aws-service-account",
                     "displayName": "AWS production (keyless)",
-                    "credentials": "{\"serviceAccountJson\":\"{\\\"authType\\\":\\\"oidc_role\\\",\\\"roleArn\\\":\\\"arn:aws:iam::123456789012:role/SimWorkflows\\\",\\\"subject\\\":\\\"sim:workspace:a91c4b2e-6d3f-4e8a-b5c7-0d9e2f1a8c64:credential:3f2a9c4e8b1d47f6a0c5e2d9b7f1a3c8\\\",\\\"subjectProof\\\":\\\"1781965031000.Zm9yIGlsbHVzdHJhdGlvbiBvbmx5IC0gbm90IGEgcmVhbCBwcm9vZg\\\"}\"}"
+                    "credentials": "{\"serviceAccountJson\":\"{\\\"authType\\\":\\\"oidc_role\\\",\\\"roleArn\\\":\\\"arn:aws:iam::123456789012:role/SimWorkflows\\\",\\\"subject\\\":\\\"sim:workspace:<workspaceId>:credential:<subjectId>\\\",\\\"subjectProof\\\":\\\"<subjectProof from Create workload identity subject>\\\"}\"}"
                   }
                 }
               }
@@ -4324,13 +4324,13 @@
                       "data": {
                         "issuer": "https://www.sim.ai/oidc/workload",
                         "audience": "sts.amazonaws.com",
-                        "subject": "sim:workspace:a91c4b2e-6d3f-4e8a-b5c7-0d9e2f1a8c64:credential:3f2a9c4e8b1d47f6a0c5e2d9b7f1a3c8",
-                        "subjectProof": "1781965031000.Zm9yIGlsbHVzdHJhdGlvbiBvbmx5IC0gbm90IGEgcmVhbCBwcm9vZg",
+                        "subject": "sim:workspace:<workspaceId>:credential:<subjectId>",
+                        "subjectProof": "<subjectProof from Create workload identity subject>",
                         "expiresAt": "2026-06-21T14:17:11.000Z",
                         "keylessConfig": {
                           "authType": "oidc_role",
-                          "subject": "sim:workspace:a91c4b2e-6d3f-4e8a-b5c7-0d9e2f1a8c64:credential:3f2a9c4e8b1d47f6a0c5e2d9b7f1a3c8",
-                          "subjectProof": "1781965031000.Zm9yIGlsbHVzdHJhdGlvbiBvbmx5IC0gbm90IGEgcmVhbCBwcm9vZg"
+                          "subject": "sim:workspace:<workspaceId>:credential:<subjectId>",
+                          "subjectProof": "<subjectProof from Create workload identity subject>"
                         },
                         "requiredConfigFields": ["roleArn"],
                         "optionalConfigFields": ["stsRegion", "sessionDurationSeconds"]
@@ -18507,13 +18507,13 @@
             "data": {
               "issuer": "https://www.sim.ai/oidc/workload",
               "audience": "sts.amazonaws.com",
-              "subject": "sim:workspace:a91c4b2e-6d3f-4e8a-b5c7-0d9e2f1a8c64:credential:3f2a9c4e8b1d47f6a0c5e2d9b7f1a3c8",
-              "subjectProof": "1781965031000.Zm9yIGlsbHVzdHJhdGlvbiBvbmx5IC0gbm90IGEgcmVhbCBwcm9vZg",
+              "subject": "sim:workspace:<workspaceId>:credential:<subjectId>",
+              "subjectProof": "<subjectProof from Create workload identity subject>",
               "expiresAt": "2026-06-21T14:17:11.000Z",
               "keylessConfig": {
                 "authType": "oidc_role",
-                "subject": "sim:workspace:a91c4b2e-6d3f-4e8a-b5c7-0d9e2f1a8c64:credential:3f2a9c4e8b1d47f6a0c5e2d9b7f1a3c8",
-                "subjectProof": "1781965031000.Zm9yIGlsbHVzdHJhdGlvbiBvbmx5IC0gbm90IGEgcmVhbCBwcm9vZg"
+                "subject": "sim:workspace:<workspaceId>:credential:<subjectId>",
+                "subjectProof": "<subjectProof from Create workload identity subject>"
               },
               "requiredConfigFields": ["roleArn"],
               "optionalConfigFields": ["stsRegion", "sessionDurationSeconds"]