fix(auth): make local verification portable

Keep upstream identity visible while limiting logout to local auth. Inject the restore privilege gate so the deterministic core tests do not depend on the host OS, and confine descriptor-backed projection tests to Linux. Accept the real remaining Pi timeout budget instead of an exact millisecond.

tools/tht/internal/setup/run_test.go

@@ -101,6 +101,7 @@ func TestRunConfiguresAndStaticallyValidatesLocalAuthBeforeComposeRender(t *test
 }
 
 func TestRunConfigureOnlyPublishesInitialProjectedServerAuthentication(t *testing.T) {
+	requireProjectedServerTestHost(t)
 	projectRoot, request := setupRunFixture(t, true)
 	request.Profile = "server"
 	if err := os.WriteFile(filepath.Join(projectRoot, "deploy", "compose.auth-runtime-projection.yaml"), []byte("services: {}\n"), 0o600); err != nil {
@@ -125,6 +126,7 @@ func TestRunConfigureOnlyPublishesInitialProjectedServerAuthentication(t *testin
 }
 
 func TestRunConfigureOnlyLeavesProjectedAuthenticationBlockedWhenInitialPublicationFails(t *testing.T) {
+	requireProjectedServerTestHost(t)
 	projectRoot, request := setupRunFixture(t, true)
 	request.Profile = "server"
 	if err := os.WriteFile(filepath.Join(projectRoot, "deploy", "compose.auth-runtime-projection.yaml"), []byte("services: {}\n"), 0o600); err != nil {
@@ -162,6 +164,7 @@ func TestRunConfigureOnlyLeavesProjectedAuthenticationBlockedWhenInitialPublicat
 }
 
 func TestRunConfigureOnlyVerifiesProjectedAuthenticationAfterPublication(t *testing.T) {
+	requireProjectedServerTestHost(t)
 	projectRoot, request := setupRunFixture(t, true)
 	request.Profile = "server"
 	if err := os.WriteFile(filepath.Join(projectRoot, "deploy", "compose.auth-runtime-projection.yaml"), []byte("services: {}\n"), 0o600); err != nil {