[LogsDB] [Stack 8.19.22-SNAPSHOT] [ti_abusech] Failing test daily: script test: commercial_token_refresh in ti_abusech.yaraify

- Stack version: 8.19.22-SNAPSHOT
- LogsDB: enabled
- Package: ti_abusech
- Failing test: script test: commercial_token_refresh
- DataStream: yaraify
- Owners:
- @elastic/security-service-integrations
- @elastic/sit-crest-contractors

Failure:
```
commercial_token_refresh.txt:23: no match for `^true$` found in stdout: RUN commercial_token_refresh
# Verify that an expired commercial JWT token triggers a fresh login request
# before collecting YARAify rule metadata on the next polling interval.
#
# The mock login endpoint returns two responses in rolling sequence:
# 1. A short-lived token (expires: 1, always stale on the next interval)
# 2. A refreshed token (expires: 4102444800)
# The rules endpoint returns a different rule on each request so we can verify
# both collection rounds succeeded after token refresh. (80.128s)
> [!external_stack] skip 'Skipping external stack test.'
> [!exec:jq] skip 'Skipping test requiring absent jq command'
> use_stack -profile ${CONFIG_PROFILES}/${PROFILE}
[stdout]
{
"provider": "compose",
"elasticsearch_host": "https://127.0.0.1:9200",
"elasticsearch_username": "elastic",
"elasticsearch_password": "changeme",
"kibana_host": "https://127.0.0.1:5601",
"ca_cert_file": "/opt/buildkite
```

First build failed: https://buildkite.com/elastic/integrations/builds/49550

Start with the ti_abusech.yaraify script test named commercial_token_refresh and reproduce the failure from Buildkite build 49550 with LogsDB enabled. Inspect the test output and token-refresh flow; done means the test passes and confirms that an expired commercial token triggers a fresh login before the next rules collection.

Written by the indexing model from the issue text.