Support tenant-scoped directory lifecycle with isolation tests

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

.forgejo/workflows/identity-journeys.yaml

@@ -0,0 +1,18 @@
+name: Identity provider journey acceptance
+on:
+  push:
+    branches: [main]
+    paths: ["identity-provisioner/**", ".forgejo/workflows/identity-journeys.yaml"]
+  workflow_dispatch:
+jobs:
+  provider:
+    runs-on: self-hosted
+    steps:
+      - name: Test the exact commit
+        run: |
+          set -eu
+          mkdir -p identity-source
+          curl -fsSL "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz" -o identity-source.tar.gz
+          tar xzf identity-source.tar.gz -C identity-source --strip-components=1
+          cd identity-source
+          PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=identity-provisioner python3 -m unittest discover -s identity-provisioner/tests -v