Support bundle-wide group run identities for jobs

[lennartkats-db]

Changes

Support bundle- and target-level run_as.group_name for jobs using the direct engine.

Why

The Jobs API supports group identities, but bundle-wide run_as rejected them.

Tests

Formatting, checks, lint, unit tests, and run-as acceptance tests passed. The full acceptance suite hit the existing shell-completion SIGPIPE failure, also reproduced on the unchanged baseline. Dogfood bundles created and ran root- and target-inherited group jobs, explicit user job overrides, and a serverless pipeline with an explicit user override. Test resources were cleaned up.

This PR was written by Codex.

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

5 files changed
Suggested: @denik
Also eligible: @janniklasrose, @andrewnester, @shreyas-goenka, @pietern, @anton-107

/bundle/ - needs approval

Files: bundle/config/mutator/resourcemutator/run_as.go, bundle/config/mutator/resourcemutator/run_as_test.go
Suggested: @denik
Also eligible: @janniklasrose, @andrewnester, @shreyas-goenka, @pietern, @anton-107

General files (require maintainer)

Files: .nextchanges/bundles/run-as-group.md
Based on git history:

• @denik -- recent work in .nextchanges/bundles/, bundle/config/mutator/resourcemutator/, acceptance/bundle/run_as/empty_run_as_dict/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @rugpanov, @rclarey) can approve all areas.
See OWNERS for ownership rules.}

[eng-dev-ecosystem-bot]

Integration test report

Commit: f8a2883

Run: 35342318885

	Env	✅​pass	🙈​skip	Time
✅​	aws linux	276	20	5:04
✅​	aws windows	278	18	4:12
✅​	azure linux	275	20	5:12
✅​	azure windows	277	18	4:15
✅​	gcp linux	276	20	5:18
✅​	gcp windows	278	18	4:11

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
3:44	azure windows	TestAccept
3:44	gcp windows	TestAccept
3:35	aws windows	TestAccept