test(turn): expect verified identity context

[huangruiteng]

Summary

• update the machine-credential dispatch test to expect the verified Turn identity context now forwarded by the built-in DSH adapter
• keep the exact machine-owned API key assertion and prove two Goal runtimes receive their own workspace identity

Root cause

The test introduced by #4846 still asserted that the SDK override map contained only DEEPSEEK_API_KEY. Main now intentionally forwards LOOPX_TURN_GOAL_ID, LOOPX_TURN_AGENT_ID, LOOPX_TURN_TODO_ID, and LOOPX_TURN_WORKSPACE so runtime tools bind to the verified invocation rather than stale ambient identity. The production contract and focused DSH tests already require those fields; only this newer credential-isolation fixture retained the old exact-dictionary expectation.

This failure reproduced in #4870's test-shard (2) and is independent of its authority-promotion diff.

Validation

• uv run --extra test pytest -q tests/test_turn_machine_credential.py — 4 passed
• uv run --extra test ruff check tests/test_turn_machine_credential.py
• uv run loopx canary premerge --from-git-diff
• git diff --check

Test-only repair; production credential ownership, Turn identity injection, and permission semantics are unchanged.