[Draft] Support bundle-wide group run identities for jobs

[lennartkats-db]

Changes

Support bundle- and target-level run_as.group_name for jobs using the direct engine.

Why

The Jobs API supports group identities, but bundle-wide run_as rejected them.

Tests

Tests and local checks pass; root- and target-level jobs ran as the group in dogfood.

This PR was written by Codex.

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

10 files changed
Suggested: @denik
Also eligible: @janniklasrose, @andrewnester, @shreyas-goenka, @pietern, @anton-107

/bundle/ - needs approval

5 files changed
Suggested: @denik
Also eligible: @janniklasrose, @andrewnester, @shreyas-goenka, @pietern, @anton-107

General files (require maintainer)

Files: .nextchanges/bundles/run-as-group.md
Based on git history:

• @denik -- recent work in .nextchanges/bundles/, bundle/config/mutator/, bundle/phases/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @rugpanov, @rclarey) can approve all areas.
See OWNERS for ownership rules.}

[eng-dev-ecosystem-bot]

Integration test report

Commit: fb182c7

Run: 35087351036

	Env	💚​RECOVERED	✅​pass	🙈​skip	Time
💚​	aws linux	1	275	21	5:45
💚​	aws windows	1	277	19	4:31
💚​	azure linux	1	274	21	4:55
💚​	azure windows	1	276	19	3:59
💚​	gcp linux	1	275	21	5:14
💚​	gcp windows	1	277	19	4:33

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
3:57	azure windows	TestAccept
3:41	aws windows	TestAccept
3:37	gcp windows	TestAccept