Tracking: add real-service tests for every credential provider

## Goal

Track real-service test coverage for every service credential provider in reqsign.

This tracker was created from `main` at [`0789a74d53db9f61ed4adb16b2aa3c89ec81f717`](https://github.com/apache/opendal-reqsign/commit/0789a74d53db9f61ed4adb16b2aa3c89ec81f717), including #823. The checklist is now updated through [`e11dde0e55a84300c0397aa1faabafcce1235c0c`](https://github.com/apache/opendal-reqsign/commit/e11dde0e55a84300c0397aa1faabafcce1235c0c), including #830.

A provider counts as **live-covered** only when CI invokes that provider and either:

1. the provider talks to the real cloud identity, metadata, or credential service; or
2. credentials returned by the provider are accepted by a real cloud service request.

Local parsing, environment/file loading, mock servers, and signer tests that construct `Credential` directly do not count as provider live coverage.

## Provider checklist

Checked items have a real-service path in current CI. Unchecked items need live coverage or an explicit documented exception.

### Alibaba Cloud OSS (0/10)

- [ ] `StaticCredentialProvider` — a real OSS integration test exists, but it is not active in current CI because the Actions secrets are empty.
- [ ] `EnvCredentialProvider` — local environment loading only.
- [ ] `OssProfileCredentialProvider` — local profile parsing only.
- [ ] `CredentialsFileCredentialProvider` — local file parsing only.
- [ ] `ConfigFileCredentialProvider` — local file parsing only.
- [ ] `CredentialsUriCredentialProvider` — mocked HTTP only.
- [ ] `EcsRamRoleCredentialProvider` — mocked metadata only.
- [ ] `AssumeRoleWithOidcCredentialProvider` — mocked STS only. The workflow exports `REQSIGN_ALIYUN_*` values, but no integration test consumes them.
- [ ] `AssumeRoleCredentialProvider` — mocked STS only.
- [ ] `DefaultCredentialProvider` — local/mocked chain coverage only.

### AWS (11/12)

- [x] `StaticCredentialProvider` — #830 invokes the provider with configured AWS credentials and validates the result with real STS `GetCallerIdentity`.
- [x] `EnvCredentialProvider` — #830 invokes the environment provider and validates the result with real STS `GetCallerIdentity`.
- [x] `ProfileCredentialProvider` — #830 loads a real credential profile through the provider and validates it with STS `GetCallerIdentity`.
- [x] `ProcessCredentialProvider` — #830 loads configured credentials through `credential_process` and validates them with STS `GetCallerIdentity`.
- [x] `DefaultCredentialProvider` — #830 adds a dedicated live default-chain job and validates the selected credential with STS `GetCallerIdentity`.
- [x] `AssumeRoleCredentialProvider` — real AWS STS `AssumeRole` plus downstream STS acceptance.
- [x] `AssumeRoleWithWebIdentityCredentialProvider` — real GitHub OIDC to AWS STS exchange.
- [x] `ECSCredentialProvider` — #830 runs inside a real Fargate task, loads task-role credentials, and validates them with STS `GetCallerIdentity`.
- [x] `IMDSv2CredentialProvider` — #830 launches an ephemeral EC2 instance, loads credentials from real IMDSv2, and validates them with STS `GetCallerIdentity`.
- [ ] `SSOCredentialProvider` — no unattended real-service CI path. The current provider requires a pre-authorized legacy SSO cache and cannot refresh authorization non-interactively; resolve this with a documented exception, provider redesign, or removal.
- [x] `CognitoIdentityCredentialProvider` — #830 calls a real Cognito identity pool and validates the returned credential with STS `GetCallerIdentity`.
- [x] `S3ExpressSessionProvider` — real S3 Express `CreateSession`.

PR #830 also adds real-service acceptance for `S3AccessGrantsGranter`; that `GrantCredential` coverage is tracked in #807 and is not part of the 12-provider count.

### Azure Storage (3/9)

- [x] `ClientSecretCredentialProvider` — real Microsoft Entra token request.
- [x] `ClientCertificateCredentialProvider` — real Microsoft Entra token request.
- [x] `AzureCliCredentialProvider` — real OIDC login followed by Azure CLI token acquisition.
- [ ] `EnvCredentialProvider` — local environment loading only.
- [ ] `StaticCredentialProvider` — invokes the provider and signs locally, but never sends the request to Azure Storage.
- [ ] `DefaultCredentialProvider` — no live workflow job.
- [ ] `ImdsCredentialProvider` — local IMDS mock only.
- [ ] `WorkloadIdentityCredentialProvider` — a gated test exists but is not wired into the workflow.
- [ ] `AzurePipelinesCredentialProvider` — a gated test exists but is not wired into the workflow.

### Google (4/10)

- [x] `StaticCredentialProvider` — used by the live Google Cloud Storage signing tests, including real OAuth and GCS requests.
- [x] `AuthorizedUserCredentialProvider` *(internal)* — real OAuth refresh-token exchange.
- [x] `ExternalAccountCredentialProvider` *(internal)* — real GitHub WIF, Google STS, and service-account impersonation.
- [x] `ImpersonatedServiceAccountCredentialProvider` *(internal)* — real IAM Credentials impersonation.
- [ ] `DefaultCredentialProvider` — loads a real credential document but does not use the result against a real service.
- [ ] `EnvCredentialProvider` — local environment loading only.
- [ ] `WellKnownCredentialProvider` — no dedicated live workflow path.
- [ ] `FileCredentialProvider` — local file loading/parsing only.
- [ ] `VmMetadataCredentialProvider` — local metadata mock only.
- [ ] `TokenCredentialProvider` — local token construction only.

### Huawei Cloud OBS (0/4)

- [ ] `ConfigCredentialProvider` *(deprecated)* — local-only coverage.
- [ ] `DefaultCredentialProvider` — local-only chain coverage.
- [ ] `EnvCredentialProvider` — local environment loading only.
- [ ] `StaticCredentialProvider` — local construction only.

The workflow runs unit tests without any Huawei Cloud credentials or real OBS request.

### Oracle (0/5)

- [ ] `ConfigCredentialProvider` *(deprecated)* — local-only coverage.
- [ ] `EnvCredentialProvider` — local environment loading only.
- [ ] `StaticCredentialProvider` — local construction only.
- [ ] `ConfigFileCredentialProvider` — local file parsing only.
- [ ] `DefaultCredentialProvider` — local-only chain coverage.

The workflow runs unit tests without any Oracle Cloud credentials or real service request.

### Tencent Cloud COS (0/5)

- [ ] `ConfigCredentialProvider` *(deprecated)* — local-only coverage.
- [ ] `DefaultCredentialProvider` — local-only chain coverage.
- [ ] `AssumeRoleWithWebIdentityCredentialProvider` — no test invokes it. The current `tencent_cloud_web_identify_test` obtains a GitHub token but does not create `TENCENTCLOUD_WEB_IDENTITY_TOKEN_FILE` or set the provider's expected `TENCENTCLOUD_*` variables.
- [ ] `EnvCredentialProvider` — local environment loading only.
- [ ] `StaticCredentialProvider` — a real COS integration test exists, but it is not active in current CI because the Actions secrets are empty.

### Volcengine TOS (0/3)

- [ ] `DefaultCredentialProvider` — local-only chain coverage.
- [ ] `EnvCredentialProvider` — local environment loading only.
- [ ] `StaticCredentialProvider` — local construction only.

`tests/presigned.rs` contains a real TOS object lifecycle test, but there is no Volcengine workflow and the test constructs `Credential` directly rather than invoking a provider.

## Completion criteria

Each unchecked provider should be resolved by either a live test or a documented exception/removal. A live test should:

- invoke the named provider, not bypass it by constructing `Credential` directly;
- call a real cloud identity/metadata endpoint or use the returned credential in a minimal real service request;
- run on `main` and trusted pull requests, or on a documented scheduled/manual environment when provider infrastructure cannot be hosted safely on GitHub-hosted runners;
- assert the live-test gate in the same step as `cargo test`, so an accidentally missing gate cannot produce a false green;
- report missing secrets as an explicit skipped job rather than a passing test that returned early;
- use least-privilege test resources and short-lived/OIDC credentials where the service supports them; and
- keep deterministic mock/unit tests as the fast protocol and error-path layer.

## Suggested order

1. Resolve AWS SSO with an explicit documented exception, provider redesign, or removal so the AWS matrix has no ambiguous item.
2. Repair the Tencent GitHub OIDC job end to end, then use the issued temporary credential to live-cover `AssumeRoleWithWebIdentityCredentialProvider`, `DefaultCredentialProvider`, `EnvCredentialProvider`, and `StaticCredentialProvider` against COS.
3. Apply the same OIDC-first pattern to Alibaba Cloud, then route the issued credential through the existing OSS acceptance path and local source providers.
4. Wire the existing Volcengine TOS acceptance test into CI and make it invoke providers rather than constructing `Credential` directly.
5. Add the remaining Azure workload-identity/pipelines and cloud-metadata paths, then record explicit exceptions for deprecated or operationally impractical providers.

This is complementary to #807: that issue tracks `GrantCredential` implementations and explicitly excludes `ProvideCredential` flows.

Start by reviewing the current CI workflow, the provider integration tests, and tests/presigned.rs; the issue also identifies tencent_cloud_web_identify_test as an incomplete entry point. Follow the suggested order, beginning with the AWS SSO decision, and ensure each unchecked provider is invoked in CI against a real service or has a documented exception matching the completion criteria.

Written by the indexing model from the issue text.